Trojan.Encoder.29718

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%ALLUSERSPROFILE%\start menu\programs\startup\_nemty_fbpf6jo_-decrypt.txt

Creates the following files on removable media

<Drive name for removable media>:\_nemty_fbpf6jo_-decrypt.txt
<Drive name for removable media>:\indogerman2010.pptx
<Drive name for removable media>:\samieee_obiee_presentation.pptx
<Drive name for removable media>:\gruenspecht_02172016.pptx
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\asaprojectcompetition.pptx
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\hanni_umami_chapter.doc
<Drive name for removable media>:\cveuropeo.doc
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\roozenedowebinar.pptx

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Executes the following

'<SYSTEM32>\taskkill.exe' /f /im sql.*
'<SYSTEM32>\net.exe' stop QBCFMontorService
'<SYSTEM32>\net.exe' stop cbVSCService11
'<SYSTEM32>\net.exe' stop CobianBackup11
'<SYSTEM32>\net.exe' stop SQLBrowser
'<SYSTEM32>\net.exe' stop SQLAgent$SQLEXPRESS
'<SYSTEM32>\net.exe' stop MongoDB
'<SYSTEM32>\net.exe' stop MSSQLServerADHelper100
'<SYSTEM32>\net.exe' stop MSSQL$SQLEXPRESS
'<SYSTEM32>\net.exe' stop SQLWriter
'<SYSTEM32>\net.exe' stop Apache2.4
'<SYSTEM32>\net.exe' stop AcronisAgent
'<SYSTEM32>\net.exe' stop AcrSch2Svc
'<SYSTEM32>\net.exe' stop OracleServiceXE
'<SYSTEM32>\net.exe' stop QBVSS
'<SYSTEM32>\net.exe' stop DbxSvc
'<SYSTEM32>\taskkill.exe' /f /im Flow.*
'<SYSTEM32>\taskkill.exe' /f /im Teams.*
'<SYSTEM32>\taskkill.exe' /f /im WBGX.*
'<SYSTEM32>\taskkill.exe' /f /im QBW32.*
'<SYSTEM32>\taskkill.exe' /f /im node.*
'<SYSTEM32>\taskkill.exe' /f /im virtualboxvm.*
'<SYSTEM32>\taskkill.exe' /f /im onenote.*
'<SYSTEM32>\taskkill.exe' /f /im excel.*
'<SYSTEM32>\taskkill.exe' /f /im oracle.*
'<SYSTEM32>\taskkill.exe' /f /im thunderbird.*
'<SYSTEM32>\taskkill.exe' /f /im outlook.*
'<SYSTEM32>\taskkill.exe' /f /im wordpad.*
'<SYSTEM32>\taskkill.exe' /f /im winword.*
'<SYSTEM32>\net.exe' stop OracleXETNSListener
'<SYSTEM32>\net.exe' stop

Modifies file system

Creates the following files

%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1229272821-842925246-1060284298-1003\650860e5119ec19a8de142e32f03c712_5f9fe710-99e6-4c04-be62-a7f1b8b321d1
%HOMEPATH%\.oracle_jre_usage\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\.purple\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\.purple\certificates\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\.purple\certificates\x509\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\.purple\certificates\x509\tls_peers\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\.purple\smileys\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\acrobat\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\acrobat\10.0\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\acrobat\10.0\collab\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\acrobat\10.0\forms\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\can\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\acrobat\10.0\javascripts\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\acrobat\10.0\security\crlcache\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\acrobat\9.0\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\acrobat\9.0\forms\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\acrobat\9.0\javascripts\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\flash player\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\flash player\assetcache\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\flash player\assetcache\mc4yk349\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\headlights\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\linguistics\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\linguistics\dictionaries\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\all\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\z9pmdpek\_nemty_fbpf6jo_-decrypt.txt
%HOMEPATH%\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\acrobat\10.0\security\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\brt\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\ee7gwdg8\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\o4q6sqop\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\qiszf4kx\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\application data\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\application data\microsoft\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\application data\microsoft\credentials\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\application data\microsoft\credentials\s-1-5-20\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\application data\microsoft\internet explorer\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\application data\microsoft\media player\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\certificates\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\crls\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\ctls\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\cookies\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\local settings\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\local settings\application data\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\local settings\application data\microsoft\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\local settings\application data\microsoft\credentials\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\local settings\application data\microsoft\credentials\s-1-5-20\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\local settings\history\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\local settings\history\history.ie5\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\local settings\temp\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\etuaii8e\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\9stcdn6y\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\h8mbgrq8\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\documents\my music\sample playlists\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\eng\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\pt\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\pt\jabber\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\pt\loading\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\ru\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\ru\error\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\ru\jabber\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\ru\loading\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\tr\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\tr\error\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\tr\jabber\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\tr\loading\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\ua\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\ua\error\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\adobe\logtransport2\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\ua\jabber\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\uz\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\uz\error\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\uz\jabber\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\uz\loading\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\skin\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\skin_cache\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\smiles\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\smiles\flash\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\smiles\smiles\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\smiles\smiles\8march\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\smiles\smiles\animated\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\kz\loading\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\kz\jabber\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\pt\error\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\kz\error\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\kz\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icq-profile\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icq-profile\update\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icq-profile\update\splash_banner\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\database\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\dll\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\fonts\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\graphics\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\graphics\phone\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\bg\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\bg\error\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\mqraz07n\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\bg\loading\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\cz\error\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\cz\jabber\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\cz\loading\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\de\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\de\error\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\de\jabber\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\de\loading\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\en\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\en\error\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\en\jabber\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\en\loading\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\bg\jabber\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icq-profile\base\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\cz\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\local settings\<INETFILES>\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\local settings\temp\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\local settings\history\history.ie5\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1040\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1041\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1042\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1046\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1049\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1050\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\2052\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\3082\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\msdn\8.0\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\network\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\network\connections\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\network\connections\cm\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\network\connections\pbk\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\network\downloader\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\office\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\office\data\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\office\groove\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft help\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\oracle\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\oracle\java\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\oracle\java\installcache\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\package cache\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1031\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1036\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1028\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\msdn\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\adobe\setup\{ac76ba86-7ad7-1033-7b44-aa1000000001}\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1229272821-842925246-1060284298-1003\94a9cdfb09e37d01f75d09c2c4488906_5f9fe710-99e6-4c04-be62-a7f1b8b321d1
C:\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\_nemty_fbpf6jo_-decrypt.txt
D:\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\adobe\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\adobe\acrobat\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\adobe\acrobat\10.0\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\adobe\acrobat\10.0\replicate\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\adobe\acrobat\10.0\replicate\security\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\adobe\arm\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\smiles\smiles\cat\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\adobe\setup\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\crypto\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\crypto\dss\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\crypto\dss\machinekeys\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\dbgclr\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\dbgclr\7.1\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\dbgclr\7.1\1033\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\html help\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\media index\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\media player\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\msdaipp\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\msdaipp\offline\_nemty_fbpf6jo_-decrypt.txt
%HOMEPATH%\adobeupdate.exe
%ALLUSERSPROFILE%\application data\adobe\updater6\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\html\ua\loading\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\start menu\programs\mirc\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\start menu\programs\qip 2012\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\start menu\programs\steam\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\start menu\programs\winrar\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\templates\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\default user\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\application data\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\application data\microsoft\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\application data\microsoft\credentials\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\application data\microsoft\credentials\s-1-5-19\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1033\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\application data\microsoft\internet explorer\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\application data\microsoft\systemcertificates\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\certificates\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\crls\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\ctls\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\cookies\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\local settings\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\local settings\application data\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\local settings\application data\microsoft\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\local settings\application data\microsoft\credentials\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\local settings\application data\microsoft\credentials\s-1-5-19\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\local settings\history\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\start menu\programs\microsoft .net framework sdk v1.1\_nemty_fbpf6jo_-decrypt.txt
C:\documents and settings\localservice\application data\microsoft\media player\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\start menu\programs\microsoft office\microsoft office tools\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\start menu\programs\microsoft office\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\start menu\programs\google chrome\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\start menu\programs\games\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\sun\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\sun\java\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\sun\java\java update\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\desktop\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\documents\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\documents\my music\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\documents\my music\my playlists\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\documents\my music\sample music\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\documents\my music\sample playlists\00107ff6\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\documents\my pictures\sample pictures\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\documents\my videos\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\drm\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\favorites\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\start menu\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\start menu\programs\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\accessibility\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\communications\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\entertainment\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\start menu\programs\accessories\system tools\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\start menu\programs\administrative tools\_nemty_fbpf6jo_-decrypt.txt
%ALLUSERSPROFILE%\documents\my pictures\_nemty_fbpf6jo_-decrypt.txt
%APPDATA%\icqm\icq\smiles\smiles\emoji\_nemty_fbpf6jo_-decrypt.txt

Sets the 'hidden' attribute to the following files

%HOMEPATH%\adobeupdate.exe

Moves the following files

from %APPDATA%\.purple\prefs.xml to %APPDATA%\.purple\prefs.xml._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\fool.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\fool.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\facepalm.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\facepalm.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\drinks.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\drinks.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\dirol.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\dirol.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\diablo.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\diablo.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\dance.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\dance.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\crazy.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\crazy.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\cray.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\cray.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\blush.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\blush.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\blum.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\blum.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\44a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\44a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\biggrin.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\biggrin.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\angel.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\angel.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\s008.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\53a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\53a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\52a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\52a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\51a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\51a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\50a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\50a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\49a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\49a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\48a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\48a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\47a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\47a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\46a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\46a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\bad.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\bad.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\45a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\45a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\give_rose.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\give_rose.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\shout.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\shout.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set04\s006.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s006.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set04\s005.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s005.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set04\s004.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s004.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set04\s003.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s003.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set04\s002.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s002.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set04\s001.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s001.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\yahoo.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\yahoo.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\wink.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\wink.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\wacko2.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\wacko2.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\unknw.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\unknw.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\kiss_mini.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\kiss_mini.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\good.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\good.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\shok.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\shok.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\scratch_one-s_head.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\scratch_one-s_head.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\sad.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\rolleyes.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\rolleyes.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\rofl.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\rofl.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\pardon.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\pardon.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\nea.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\nea.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\music.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\music.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\mocking.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\mocking.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\man_in_love.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\man_in_love.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set03\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\smile.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set04\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s008.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set04\s007.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s007.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\41b.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\41b.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\01.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\01.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\11a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\11a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\10a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\10a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\09a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\09a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\08a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\08a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\07a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\07a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\06a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\06a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\04b.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\04b.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\03a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\03a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\02.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\02.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\12a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\12a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\13a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\13a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\42a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\42a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\wink.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\wink.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\wacko1.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\wacko1.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\unknown.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\unknown.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\sorry.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\sorry.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\smile.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\shout.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\shout.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\shok.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\shok.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\scratch_one-s_head.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\scratch_one-s_head.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\sad.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\yahoo.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\yahoo.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\43a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\43a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\14a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\14a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\28a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\28a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\29a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\29a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\39a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\39a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\38a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\38a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\37.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\37.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\36a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\36a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\34a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\34a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\33a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\33a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\32a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\32a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\31a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\31a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\30a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\30a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\40a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\40a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\15a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\15a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\16a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\16a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\26a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\26a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\25a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\25a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\24a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\24a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\23a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\23a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\22a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\22a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\21a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\21a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\20a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\20a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\19a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\19a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\17a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\17a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\27a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\27a.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set04\s009.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s009.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\plug.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\plug.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\hm.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\hm.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\pig.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\pig.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\oo.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\oo.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\ok.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\ok.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\live.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\live.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\laughter.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\laughter.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\kukes.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\kukes.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_right.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_right.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_left.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_left.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\kiss.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\rrr.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\rrr.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\really.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\really.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\blink.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\blink.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\fist.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\fist.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\disappointed.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\disappointed.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\die.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\die.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\devil.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\devil.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\detzl.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\detzl.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\cry.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\cry.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\crocodile.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\crocodile.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\coolguy.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\coolguy.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\bullshit.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\bullshit.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\fuck.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\fuck.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\heart.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\heart.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\shy.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\shy.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\biggrin.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\biggrin.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_offline.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_offline.ico._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_gray.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_gray.ico._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_busy.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_busy.ico._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_away.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_away.ico._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\valentine\want_you.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\want_you.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\valentine\undress.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\undress.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\valentine\on_wings.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\on_wings.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\valentine\lets_play.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\lets_play.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\valentine\kissed.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\kissed.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\sceptic.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\sceptic.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_online.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_online.ico._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\valentine\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\kiss.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\valentine\dont_be_late.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\dont_be_late.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\valentine\broken_heart.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\broken_heart.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\zloradstvo.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\zloradstvo.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\victory.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\victory.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\vampire.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\vampire.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\think.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\think.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\tears.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\tears.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\smile.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\sleepy.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\sleepy.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\valentine\jealousy.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\jealousy.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\valentine\in_love.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\in_love.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\biganger.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\biganger.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\bee.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\bee.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s016.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s016.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s014.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s014.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s013.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s013.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s012.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s012.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s011.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s011.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s010.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s010.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s009.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s009.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s008.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s007.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s007.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s017.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s017.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s006.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s006.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s004.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s004.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s003.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s003.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s002.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s002.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s001.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s001.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set04\s016.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s016.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set04\s015.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s015.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set04\s014.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s014.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set04\s013.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s013.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set04\s012.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s012.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set04\s011.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s011.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s005.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s005.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s018.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s018.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s019.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s019.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s015.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s015.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set05\s020.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s020.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\ass.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\ass.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set06\s013.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s013.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\angry.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\angry.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\amazed.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\amazed.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\aaa.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\aaa.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set06\s020.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s020.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set06\s019.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s019.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set06\s018.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s018.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set06\s017.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s017.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set06\s016.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s016.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set06\s015.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s015.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set06\s014.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s014.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set06\s012.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s012.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\smiles\bazilio.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\bazilio.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set06\s011.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s011.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set06\s010.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s010.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set06\s009.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s009.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set06\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s008.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set06\s006.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s006.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set06\s004.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s004.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set06\s003.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s003.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set06\s002.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s002.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set06\s001.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s001.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\rofl.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\rofl.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\yes.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\yes.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\pardon.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\pardon.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\nea.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\nea.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\music.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\music.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\kot_wow.swf to %APPDATA%\icqm\icq\smiles\flash\kot_wow.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\rabotaet.swf to %APPDATA%\icqm\icq\smiles\flash\rabotaet.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\missyou.swf to %APPDATA%\icqm\icq\smiles\flash\missyou.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\mad dog.swf to %APPDATA%\icqm\icq\smiles\flash\mad dog.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\likeu.swf to %APPDATA%\icqm\icq\smiles\flash\likeu.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\laugh.swf to %APPDATA%\icqm\icq\smiles\flash\laugh.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\krizis.swf to %APPDATA%\icqm\icq\smiles\flash\krizis.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf to %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\serdze.swf to %APPDATA%\icqm\icq\smiles\flash\serdze.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf to %APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf to %APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf to %APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\kot_cool.swf to %APPDATA%\icqm\icq\smiles\flash\kot_cool.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\kisses.swf to %APPDATA%\icqm\icq\smiles\flash\kisses.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\joy.swf to %APPDATA%\icqm\icq\smiles\flash\joy.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\information.swf to %APPDATA%\icqm\icq\smiles\flash\information.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\guby.swf to %APPDATA%\icqm\icq\smiles\flash\guby.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\gangsta.swf to %APPDATA%\icqm\icq\smiles\flash\gangsta.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\duh.swf to %APPDATA%\icqm\icq\smiles\flash\duh.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\kot_obida.swf to %APPDATA%\icqm\icq\smiles\flash\kot_obida.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf to %APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\skratch.swf to %APPDATA%\icqm\icq\smiles\flash\skratch.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\mrasmileslang_kz.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_kz.xml._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\mrasmileslang_pt.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_pt.xml._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\8march\car.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\car.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\skin.txt to %APPDATA%\icqm\icq\smiles\skin.txt._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\mrasmileslang_uz.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_uz.xml._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\mrasmileslang_ua.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_ua.xml._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\mrasmileslang_tr.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_tr.xml._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\mrasmileslang_ru.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_ru.xml._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\smeh.swf to %APPDATA%\icqm\icq\smiles\flash\smeh.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\sobaka.swf to %APPDATA%\icqm\icq\smiles\flash\sobaka.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\mrasmileslang_de.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_de.xml._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\mrasmileslang_cz.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_cz.xml._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\mrasmileslang_bg.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_bg.xml._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\zadolbal.swf to %APPDATA%\icqm\icq\smiles\flash\zadolbal.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\wf_love_srazila.swf to %APPDATA%\icqm\icq\smiles\flash\wf_love_srazila.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf to %APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\tank.swf to %APPDATA%\icqm\icq\smiles\flash\tank.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\sorry.swf to %APPDATA%\icqm\icq\smiles\flash\sorry.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf to %APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\mrasmileslang_en.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_en.xml._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf to %APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\drako_love.swf to %APPDATA%\icqm\icq\smiles\flash\drako_love.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\database\citylist_en.csv to %APPDATA%\icqm\icq\database\citylist_en.csv._nemty_fbpf6jo_
from %APPDATA%\icq-profile\update\languages.hash to %APPDATA%\icq-profile\update\languages.hash._nemty_fbpf6jo_
from %APPDATA%\icq-profile\update\languages.dict to %APPDATA%\icq-profile\update\languages.dict._nemty_fbpf6jo_
from %APPDATA%\icq-profile\update\languages.aff to %APPDATA%\icq-profile\update\languages.aff._nemty_fbpf6jo_
from %APPDATA%\icq-profile\installerlang.xml to %APPDATA%\icq-profile\installerlang.xml._nemty_fbpf6jo_
from %APPDATA%\icq-profile\base\mra.dbs to %APPDATA%\icq-profile\base\mra.dbs._nemty_fbpf6jo_
from %APPDATA%\adobe\acrobat\9.0\usercache.bin to %APPDATA%\adobe\acrobat\9.0\usercache.bin._nemty_fbpf6jo_
from %APPDATA%\adobe\acrobat\9.0\shareddataevents to %APPDATA%\adobe\acrobat\9.0\shareddataevents._nemty_fbpf6jo_
from %APPDATA%\adobe\acrobat\9.0\javascripts\glob.settings.js to %APPDATA%\adobe\acrobat\9.0\javascripts\glob.settings.js._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\database\citylist_ru.csv to %APPDATA%\icqm\icq\database\citylist_ru.csv._nemty_fbpf6jo_
from %APPDATA%\adobe\acrobat\9.0\javascripts\glob.js to %APPDATA%\adobe\acrobat\9.0\javascripts\glob.js._nemty_fbpf6jo_
from %APPDATA%\adobe\acrobat\9.0\adobecmapfnt09.lst to %APPDATA%\adobe\acrobat\9.0\adobecmapfnt09.lst._nemty_fbpf6jo_
from %APPDATA%\adobe\acrobat\10.0\tmgrpprm.sav to %APPDATA%\adobe\acrobat\10.0\tmgrpprm.sav._nemty_fbpf6jo_
from %APPDATA%\adobe\acrobat\10.0\tmdocs.sav to %APPDATA%\adobe\acrobat\10.0\tmdocs.sav._nemty_fbpf6jo_
from %APPDATA%\adobe\acrobat\10.0\security\crlcache\a9b8213768adc68af64fcc6409e8be414726687f.crl to %APPDATA%\adobe\acrobat\10.0\security\crlcache\a9b8213768adc68af64fcc6409e8be414726687f.crl._nemty_fbpf6jo_
from %APPDATA%\adobe\acrobat\10.0\security\crlcache\48b76449f3d5fefa1133aa805e420f0fca643651.crl to %APPDATA%\adobe\acrobat\10.0\security\crlcache\48b76449f3d5fefa1133aa805e420f0fca643651.crl._nemty_fbpf6jo_
from %APPDATA%\adobe\acrobat\10.0\security\addressbook.acrodata to %APPDATA%\adobe\acrobat\10.0\security\addressbook.acrodata._nemty_fbpf6jo_
from %APPDATA%\adobe\acrobat\10.0\readermessages to %APPDATA%\adobe\acrobat\10.0\readermessages._nemty_fbpf6jo_
from %APPDATA%\adobe\acrobat\10.0\javascripts\glob.settings.js to %APPDATA%\adobe\acrobat\10.0\javascripts\glob.settings.js._nemty_fbpf6jo_
from %APPDATA%\adobe\acrobat\10.0\javascripts\glob.js to %APPDATA%\adobe\acrobat\10.0\javascripts\glob.js._nemty_fbpf6jo_
from %APPDATA%\.purple\status.xml to %APPDATA%\.purple\status.xml._nemty_fbpf6jo_
from %APPDATA%\adobe\acrobat\9.0\adobesysfnt09.lst to %APPDATA%\adobe\acrobat\9.0\adobesysfnt09.lst._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\database\citylist_tr.csv to %APPDATA%\icqm\icq\database\citylist_tr.csv._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\database\citylist_kz.csv to %APPDATA%\icqm\icq\database\citylist_kz.csv._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\database\citylist_ua.csv to %APPDATA%\icqm\icq\database\citylist_ua.csv._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf to %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\akitaka.swf to %APPDATA%\icqm\icq\smiles\flash\akitaka.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf to %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\devochka.swf to %APPDATA%\icqm\icq\smiles\flash\devochka.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\chillout.swf to %APPDATA%\icqm\icq\smiles\flash\chillout.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\canthearu.swf to %APPDATA%\icqm\icq\smiles\flash\canthearu.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\boo.swf to %APPDATA%\icqm\icq\smiles\flash\boo.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\bodun.swf to %APPDATA%\icqm\icq\smiles\flash\bodun.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\beer.swf to %APPDATA%\icqm\icq\smiles\flash\beer.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\beback.swf to %APPDATA%\icqm\icq\smiles\flash\beback.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf to %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\angel.swf to %APPDATA%\icqm\icq\smiles\flash\angel.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\database\citylist_uz.csv to %APPDATA%\icqm\icq\database\citylist_uz.csv._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\dll\altergeo.msi to %APPDATA%\icqm\icq\dll\altergeo.msi._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_away.ico to %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_away.ico._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\set04\s010.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s010.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\devil.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\devil.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\biggrin.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\biggrin.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\bad.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\bad.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\air_kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\air_kiss.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\tongue out.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\tongue out.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thumbs up.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thumbs up.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thank you.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thank you.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\surprised.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\surprised.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\stop.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\stop.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\smile.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\blum1.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\blum1.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\scream.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\scream.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\nothing to say.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\nothing to say.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\mad.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\mad.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\listening to music.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\listening to music.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing out loud (lol).gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing out loud (lol).gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissing.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissing.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissed.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissed.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kiss.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\in love.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\in love.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\gross.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\gross.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\sad.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\falling asleep.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\falling asleep.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\bomb.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\bomb.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\bye2.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\bye2.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\flash\rosy.swf to %APPDATA%\icqm\icq\smiles\flash\rosy.swf._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\mocking.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\mocking.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\man_in_love.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\man_in_love.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\mad.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\mad.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\lol.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\lol.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss3.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss3.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\i_am_so_happy.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\i_am_so_happy.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\ireful.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\ireful.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\hi.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\hi.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_rose.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_rose.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\hang1.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\hang1.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\good.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\good.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_heart.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_heart.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\girl_angel.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\girl_angel.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\gamer.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\gamer.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\drinks.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\drinks.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\diablo.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\diablo.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\dance.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\dance.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\cry.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\cry.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\crazy.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\crazy.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\cool.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\cool.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\blush.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\blush.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\drinking.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\drinking.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\crying.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\crying.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\cool.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\cool.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\book.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\book.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\gg.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gg.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\flowr.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\flowr.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\fingal.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\fingal.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\fight.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\fight.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\eat.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\eat.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\devil.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\devil.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\dance.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\dance.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\could.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\could.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\gg2.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gg2.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\gift.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gift.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\history.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\history.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\hungry.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\hungry.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\bomb.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\bomb.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\love.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\love.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\can't say-shut up.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\can't say-shut up.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\victory.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\victory.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blushing.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blushing.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blinking.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blinking.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\angel.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\angel.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_paper.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_paper.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_mouse.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_mouse.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_meow.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_meow.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_lick.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_lick.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_hand.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_hand.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_attack.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_attack.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\wonder.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\wonder.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\tongue.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\tongue.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\kiss.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\smile.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\sleep.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sleep.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\skuka.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\skuka.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\sing.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sing.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sad.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\red.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\red.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\rainbow.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\rainbow.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\poison.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\poison.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\animated\pistolet.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\pistolet.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\smiles\8march\love.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\love.gif._nemty_fbpf6jo_
from %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_busy.ico to %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_busy.ico._nemty_fbpf6jo_

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

UDP

DNS ASK ap#.#pify.org

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c taskkill /f /im sql.*' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net stop' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net stop QBVSS' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net stop QBCFMontorService' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net stop cbVSCService11' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net stop CobianBackup11' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net stop SQLBrowser' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net stop SQLAgent$SQLEXPRESS' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net stop MongoDB' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net stop MSSQLServerADHelper100' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net stop MSSQL$SQLEXPRESS' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net stop SQLWriter' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net stop Apache2.4' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net stop AcronisAgent' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net stop AcrSch2Svc' (with hidden window)
'<SYSTEM32>\cmd.exe' /c schtasks.exe /create /sc onstart /tn "_NEMTY_FBPF6JO_" /tr "%HOMEPATH%\AdobeUpdate.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net stop OracleServiceXE' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net stop DbxSvc' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im Flow.*' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im Teams.*' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im WBGX.*' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im QBW32.*' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im node.*' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im virtualboxvm.*' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im onenote.*' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im excel.*' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im oracle.*' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im thunderbird.*' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im outlook.*' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im wordpad.*' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im winword.*' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net stop OracleXETNSListener' (with hidden window)
'<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowc...' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c taskkill /f /im sql.*
'<SYSTEM32>\net1.exe' stop Apache2.4
'<SYSTEM32>\cmd.exe' /c net stop MSSQLServerADHelper100
'<SYSTEM32>\net1.exe' stop SQLWriter
'<SYSTEM32>\cmd.exe' /c net stop MongoDB
'<SYSTEM32>\net1.exe' stop MSSQL$SQLEXPRESS
'<SYSTEM32>\cmd.exe' /c net stop SQLAgent$SQLEXPRESS
'<SYSTEM32>\net1.exe' stop MSSQLServerADHelper100
'<SYSTEM32>\cmd.exe' /c net stop SQLBrowser
'<SYSTEM32>\cmd.exe' /c net stop CobianBackup11
'<SYSTEM32>\net1.exe' stop MongoDB
'<SYSTEM32>\net1.exe' stop SQLAgent$SQLEXPRESS
'<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowc...
'<SYSTEM32>\cmd.exe' /c net stop QBCFMontorService
'<SYSTEM32>\net1.exe' stop SQLBrowser
'<SYSTEM32>\net1.exe' stop CobianBackup11
'<SYSTEM32>\cmd.exe' /c net stop QBVSS
'<SYSTEM32>\net1.exe' stop cbVSCService11
'<SYSTEM32>\cmd.exe' /c net stop
'<SYSTEM32>\net1.exe' stop QBCFMontorService
'<SYSTEM32>\net1.exe' stop QBVSS
'<SYSTEM32>\net1.exe' stop
'<SYSTEM32>\cmd.exe' /c schtasks.exe /create /sc onstart /tn "_NEMTY_FBPF6JO_" /tr "%HOMEPATH%\AdobeUpdate.exe"
'<SYSTEM32>\cmd.exe' /c net stop MSSQL$SQLEXPRESS
'<SYSTEM32>\cmd.exe' /c net stop cbVSCService11
'<SYSTEM32>\net1.exe' stop AcronisAgent
'<SYSTEM32>\cmd.exe' /c taskkill /f /im WBGX.*
'<SYSTEM32>\cmd.exe' /c taskkill /f /im winword.*
'<SYSTEM32>\cmd.exe' /c taskkill /f /im wordpad.*
'<SYSTEM32>\cmd.exe' /c taskkill /f /im outlook.*
'<SYSTEM32>\cmd.exe' /c taskkill /f /im thunderbird.*
'<SYSTEM32>\cmd.exe' /c taskkill /f /im oracle.*
'<SYSTEM32>\cmd.exe' /c taskkill /f /im excel.*
'<SYSTEM32>\cmd.exe' /c taskkill /f /im onenote.*
'<SYSTEM32>\cmd.exe' /c taskkill /f /im virtualboxvm.*
'<SYSTEM32>\cmd.exe' /c taskkill /f /im node.*
'<SYSTEM32>\cmd.exe' /c taskkill /f /im QBW32.*
'<SYSTEM32>\cmd.exe' /c taskkill /f /im Teams.*
'<SYSTEM32>\cmd.exe' /c net stop SQLWriter
'<SYSTEM32>\cmd.exe' /c taskkill /f /im Flow.*
'<SYSTEM32>\cmd.exe' /c net stop DbxSvc
'<SYSTEM32>\cmd.exe' /c net stop OracleXETNSListener
'<SYSTEM32>\cmd.exe' /c net stop OracleServiceXE
'<SYSTEM32>\cmd.exe' /c net stop AcrSch2Svc
'<SYSTEM32>\cmd.exe' /c net stop AcronisAgent
'<SYSTEM32>\net1.exe' stop DbxSvc
'<SYSTEM32>\cmd.exe' /c net stop Apache2.4
'<SYSTEM32>\net1.exe' stop OracleServiceXE
'<SYSTEM32>\net1.exe' stop OracleXETNSListener
'<SYSTEM32>\net1.exe' stop AcrSch2Svc
'<SYSTEM32>\schtasks.exe' /create /sc onstart /tn "_NEMTY_FBPF6JO_" /tr "%HOMEPATH%\AdobeUpdate.exe"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial