Trojan.Encoder.32780

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\desktop.ini.flowencryption

Modifies file system

Creates the following files

%HOMEPATH%\downloads\chromesetup.exe.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\dnd.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\dnd_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\doma.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\em.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gde_ia.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gizn_gavno.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\chat_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\cherep.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gotovlu.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_krivetko.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_poteralsa.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_soshl_asuma.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_utko.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\igrau.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\kuru.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gulau.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_inoplanet_razum.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\chat.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\boleu.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\belka.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\92.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\92_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\93.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\93_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\94.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\94_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\95.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\91_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\95_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\96_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\97.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\97_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\98.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\98_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\99.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\99_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\96.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\kut.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\na_rabote.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_mobile.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\na_vstreche.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_43.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_44.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_45.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_49.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_50.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_41.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_42.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away_big.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_connecting.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_connecting_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible_big.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible_xp_big.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away_xp_big.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_40.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_38.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_37.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\pivo_bit.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\pu_kofe.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\rabotau.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\rocket.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\seekfriends.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\seekfriends_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\splu.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\pivo.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\splu_bit.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_29.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_30.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_32.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_33.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_34.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_35.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_36.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\star.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\91.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\music.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\90_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\69_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\61_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\62.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\62_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\63.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\63_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\64.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\60_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\61.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\64_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\66.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\66_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\67.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\67_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\68.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\68_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\65.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\65_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\60.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\59_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\59.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\103.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\103_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\104.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\104_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\11.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\11_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\12.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\102_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\12_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\13_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\56.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\56_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\57.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\57_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\58.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\58_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\13.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\69.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\70.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\89_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\70_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\82.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\82_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\83.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\83_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\84.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\84_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\81.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\81_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\85.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\86_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\87.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\87_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\88.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\88_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\89.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\85_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\86.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\80_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\80.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\79_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\71_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\72.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\72_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\73.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\73_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\74.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\74_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\71.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\75.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\76.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\76_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\77.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\77_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\78.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\78_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\79.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\75_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\90.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\status_mobile.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\blum.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s002.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s003.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s004.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s006.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s008.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s009.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\zloradstvo.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s001.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s010.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s013.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s014.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s015.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s016.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s017.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s018.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s011.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s012.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\victory.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\vampire.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\think.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\koza_left.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\koza_right.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\kukes.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\laughter.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\live.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\ok.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\oo.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\kiss.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\pig.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\really.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\rrr.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\sceptic.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\shy.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\sleepy.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\smile.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\tears.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\plug.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s019.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s001.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline_big.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s002.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s005.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s006.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s007.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s008.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s009.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s010.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s003.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s004.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s011.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s014.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s015.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s016.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\angel.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\bad.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\biggrin.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s012.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s013.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s002.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s001.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s020.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s004.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s005.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s006.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s007.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s008.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s009.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s010.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s003.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s011.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s013.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s014.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s015.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s016.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s017.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s018.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s019.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s012.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\hm.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\102.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\heart.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\seekfriends_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_gray.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_invisible.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_offline.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_online.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\seekfriends.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\24bit.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_chat.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_dnd.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_away.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_dnd.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_gray.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_invisible.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_offline.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_online.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_wrong_data.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_chat.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_connecting.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_away.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_wrong_data.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_online.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online_big.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online_xp_big.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\telefon.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\telefon_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\vi_oshiblis_nomerom.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline_xp_big.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\vi_oshiblis_nomerom_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_institute_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_shkole.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_shkole_xp.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\wrong_data.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_connecting.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_gray.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_offline.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_institute.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\seekfriends.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\fist.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_away.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\angry.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\ass.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\bazilio.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\bee.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\biganger.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\biggrin.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\aaa.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\amazed.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\blink.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\crocodile.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\cry.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\detzl.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\devil.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\die.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\disappointed.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\bullshit.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\coolguy.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\want_you.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\undress.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\on_wings.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_gray.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_offline.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_online.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_away.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_busy.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_gray.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_offline.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_busy.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_online.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\broken_heart.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\dont_be_late.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\in_love.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\jealousy.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\kiss.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\kissed.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\lets_play.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\s008.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\fuck.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s020.gif.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\101_xp.ico.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk.flowencryption
%APPDATA%\opera software\opera stable\extension state\000003.ldb.flowencryption
%APPDATA%\opera software\opera stable\extension state\000006.ldb.flowencryption
%APPDATA%\opera software\opera stable\extension state\000007.log.flowencryption
%APPDATA%\opera software\opera stable\extension state\log.old.flowencryption
%APPDATA%\opera software\opera stable\dictionaries\dictionaries.xml.flowencryption
%APPDATA%\opera software\opera stable\databases\databases.db.flowencryption
%APPDATA%\opera software\opera stable\jump list icons\524f.tmp.flowencryption
%APPDATA%\opera software\opera stable\jump list icons\529f.tmp.flowencryption
%APPDATA%\opera software\opera stable\databases\databases.db-journal.flowencryption
%APPDATA%\mra\update\languages.dict.flowencryption
%APPDATA%\mra\update\languages.hash.flowencryption
%APPDATA%\mra\update\ver.txt.flowencryption
%APPDATA%\mra\update\vvlog.dat.flowencryption
%APPDATA%\mra\base\mra.dbs.flowencryption
%APPDATA%\mra\base\opt.dbs.flowencryption
%APPDATA%\mra\installerlang.xml.flowencryption
%APPDATA%\mra\update\languages.aff.flowencryption
%APPDATA%\opera software\opera stable\jump list icons\51ff.tmp.flowencryption
%APPDATA%\opera software\opera stable\jump list icons\51ce.tmp.flowencryption
%APPDATA%\opera software\opera stable\jump list icons\516e.tmp.flowencryption
%APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\databases.db-journal.flowencryption
%APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage.flowencryption
%APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage-journal.flowencryption
%APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage.flowencryption
%APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage-journal.flowencryption
%APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage.flowencryption
%APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage-journal.flowencryption
%APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\databases.db.flowencryption
%APPDATA%\opera software\opera stable\jump list iconsold\3651.tmp.flowencryption
%APPDATA%\opera software\opera stable\jump list iconsold\36c3.tmp.flowencryption
%APPDATA%\opera software\opera stable\jump list iconsold\3703.tmp.flowencryption
%APPDATA%\opera software\opera stable\jump list iconsold\3724.tmp.flowencryption
%APPDATA%\opera software\opera stable\jump list iconsold\3765.tmp.flowencryption
%APPDATA%\opera software\opera stable\jump list iconsold\3796.tmp.flowencryption
%APPDATA%\opera software\opera stable\jump list icons\50ed.tmp.flowencryption
%APPDATA%\opera software\opera stable\jump list icons\514d.tmp.flowencryption
%APPDATA%\opera software\opera stable\jump list iconsold\36a1.tmp.flowencryption
%APPDATA%\mozilla\firefox\profiles.ini.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\blocklist.xml.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\state.json.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cert8.db.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\user.js.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webappsstore.sqlite.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webappsstore.sqlite-shm.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webappsstore.sqlite-wal.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\xulstore.json.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\webapps.json.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sitesecurityservicestate.txt.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\times.json.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\.metadata.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\recovery.js.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\upgrade.js-20150415140819.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\gmpopenh264.dll.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\gmpopenh264.info.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.3\gmpopenh264.dll.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.3\gmpopenh264.info.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\previous.js.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessioncheckpoints.json.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\secmod.db.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\search.json.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\content-prefs.sqlite.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cookies.sqlite.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cookies.sqlite-shm.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.ini.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.json.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\formhistory.sqlite.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\healthreport.sqlite.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\compatibility.ini.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\key3.db.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\permissions.sqlite.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\places.sqlite.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\places.sqlite-shm.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\places.sqlite-wal.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\pluginreg.dat.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\revocations.txt.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\mimetypes.rdf.flowencryption
%APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log.old.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\addons.json.flowencryption
%APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000006.log.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\mailviews.dat.flowencryption
%APPDATA%\winamp\plugins\milkdrop2\milk2_img.ini.flowencryption
%APPDATA%\winamp\plugins\milkdrop2\milk2_msg.ini.flowencryption
%APPDATA%\thunderbird\profiles.ini.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\abook.mab.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\blist.sqlite.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\blocklist.xml.flowencryption
%APPDATA%\winamp\winamp.m3u8.flowencryption
%APPDATA%\winamp\plugins\ml\ml_online.ini.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\cert8.db.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.ini.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.json.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\foldertree.json.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\global-messages-db.sqlite.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\history.mab.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\key3.db.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\compatibility.ini.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite.flowencryption
%APPDATA%\winamp\winamp.ini.flowencryption
%APPDATA%\winamp\links.xml.flowencryption
%APPDATA%\winamp\demo.mp3.flowencryption
%HOMEPATH%\downloads\icq_rfrset.exe.flowencryption
%HOMEPATH%\downloads\jre-8u45-windows-x64.exe.flowencryption
%HOMEPATH%\downloads\k-lite_codec_pack_1110_mega.exe.flowencryption
%HOMEPATH%\downloads\k-lite_codec_pack_1110_mega_dlm.exe.flowencryption
%HOMEPATH%\downloads\magent_rfrset.exe.flowencryption
%HOMEPATH%\downloads\mirc741.exe.flowencryption
%HOMEPATH%\downloads\opera_ni_stable.exe.flowencryption
%HOMEPATH%\downloads\desktop.ini.flowencryption
%HOMEPATH%\downloads\pidgin-2.10.11.exe.flowencryption
%HOMEPATH%\downloads\tcmd851ax64.exe.flowencryption
%HOMEPATH%\downloads\thunderbird setup 31.6.0.exe.flowencryption
%HOMEPATH%\downloads\winamp5666_full_all.exe.flowencryption
%HOMEPATH%\pictures\desktop.ini.flowencryption
%HOMEPATH%\music\desktop.ini.flowencryption
%HOMEPATH%\videos\desktop.ini.flowencryption
%HOMEPATH%\documents\desktop.ini.flowencryption
%HOMEPATH%\downloads\steamsetup.exe.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\localstore.rdf.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\parent.lock.flowencryption
%APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000003.ldb.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\permissions.sqlite.flowencryption
%APPDATA%\opera software\opera stable\favorites.db.flowencryption
%APPDATA%\opera software\opera stable\favorites.db-journal.flowencryption
%APPDATA%\opera software\opera stable\opera_autoupdate.log.flowencryption
%APPDATA%\opera software\opera stable\opera_shutdown_ms.txt.flowencryption
%APPDATA%\opera software\opera stable\session.db.flowencryption
%APPDATA%\opera software\opera stable\session.db-journal.flowencryption
%APPDATA%\opera software\opera stable\bookmarks.bak.flowencryption
%APPDATA%\opera software\opera stable\browser.js.flowencryption
%APPDATA%\opera software\opera stable\session.dbak.flowencryption
%APPDATA%\opera software\opera stable\ssdfp2216.0.2078311798.flowencryption
%APPDATA%\opera software\opera stable\ssdfp2512.4.1739910927.flowencryption
%APPDATA%\opera software\opera stable\ssdfp2544.3.670597881.flowencryption
%APPDATA%\opera software\opera stable\thumbnails.db.flowencryption
%APPDATA%\opera software\opera stable\thumbnails.db-journal.flowencryption
%APPDATA%\opera software\opera stable\update_prefs.json.flowencryption
%APPDATA%\opera software\opera stable\siteprefs.json.flowencryption
%APPDATA%\opera software\opera stable\ssdfp1652.1.1724122967.flowencryption
%APPDATA%\qipguard\sqlite3.dll.flowencryption
%APPDATA%\qipguard\qipguard_upd.exe.flowencryption
%APPDATA%\qipguard\qipguard.exe.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\prefs.js.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\secmod.db.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\session.json.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\sessioncheckpoints.json.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\times.json.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\virtualfolders.dat.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\webappsstore.sqlite.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\places.sqlite.flowencryption
%APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\store.json.mozlz4.flowencryption
%APPDATA%\telegram desktop\telegram.exe.flowencryption
%APPDATA%\telegram desktop\unins000.dat.flowencryption
%APPDATA%\telegram desktop\unins000.exe.flowencryption
%APPDATA%\telegram desktop\updater.exe.flowencryption
%APPDATA%\telegram desktop\tdata\shortcuts-custom.json.flowencryption
%APPDATA%\telegram desktop\tdata\shortcuts-default.json.flowencryption
%APPDATA%\qipguard\chrome.dll.flowencryption
%APPDATA%\telegram desktop\log.txt.flowencryption
%APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000004.log.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\100_xp.ico.flowencryption
%APPDATA%\mirc\mirc.ini.flowencryption
%APPDATA%\microsoft\office\recent\templates.lnk.flowencryption
%APPDATA%\microsoft\office\recent\virtual-machiene-introspection.lnk.flowencryption
%APPDATA%\microsoft\office\recent\vm introspection.lnk.flowencryption
%APPDATA%\microsoft\office\recent\xml_excel.lnk.flowencryption
%APPDATA%\microsoft\office\recent\xml_excel_wiki.lnk.flowencryption
%APPDATA%\microsoft\office\recent\_copy_license_ja.lnk.flowencryption
%APPDATA%\microsoft\office\recent\license_ja.lnk.flowencryption
%APPDATA%\microsoft\office\recent\protect.lnk.flowencryption
%APPDATA%\microsoft\network\connections\pbk\_hiddenpbk\rasphone.pbk.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\icq.lnk.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\mail.ru agent.lnk.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\mozilla thunderbird.lnk.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\qip 2012.lnk.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\desktop.ini.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk.flowencryption
%APPDATA%\microsoft\office\recent\license_en.lnk.flowencryption
%APPDATA%\microsoft\office\recent\clarify.lnk.flowencryption
%APPDATA%\microsoft\office\mso1033.acl.flowencryption
%APPDATA%\microsoft\windows\cookies\user@mozilla[2].txt.flowencryption
%APPDATA%\microsoft\windows\cookies\user@msn[1].txt.flowencryption
%APPDATA%\microsoft\windows\cookies\user@msn[2].txt.flowencryption
%APPDATA%\microsoft\windows\cookies\user@onlinestores.metaservices.microsoft[1].txt.flowencryption
%APPDATA%\microsoft\windows\cookies\user@scorecardresearch[2].txt.flowencryption
%APPDATA%\microsoft\windows\cookies\user@scorecardresearch[3].txt.flowencryption
%APPDATA%\microsoft\windows\cookies\user@sportiv[2].txt.flowencryption
%APPDATA%\microsoft\windows\cookies\user@demdex[2].txt.flowencryption
%APPDATA%\microsoft\windows\cookies\user@www.bing[1].txt.flowencryption
%APPDATA%\microsoft\windows\cookies\user@www.msn[3].txt.flowencryption
%APPDATA%\microsoft\windows\cookies\user@yandex[1].txt.flowencryption
%APPDATA%\microsoft\windows\cookies\user@yandex[2].txt.flowencryption
%APPDATA%\microsoft\uproof\custom.dic.flowencryption
%APPDATA%\microsoft\uproof\excludedictionaryen0409.lex.flowencryption
%APPDATA%\microsoft\uproof\excludedictionaryen0809.lex.flowencryption
%APPDATA%\microsoft\templates\normal.dotm.flowencryption
%APPDATA%\microsoft\windows\cookies\user@www.msn[2].txt.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\winamp.lnk.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\bookmarkbackups\bookmarks-2020-09-09_14_x5qkry9yysawyostzmcdfa==.jsonlz4.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk.flowencryption
%APPDATA%\mail.ru\agent\mra\sounds\letter.wav.flowencryption
%APPDATA%\mail.ru\agent\mra\sounds\message.wav.flowencryption
%APPDATA%\mail.ru\agent\mra\sounds\no_answer.wav.flowencryption
%APPDATA%\mail.ru\agent\mra\sounds\otprav.wav.flowencryption
%APPDATA%\mail.ru\agent\mra\sounds\ring.wav.flowencryption
%APPDATA%\mail.ru\agent\mra\sounds\start.wav.flowencryption
%APPDATA%\mail.ru\agent\mra\sounds\conference.wav.flowencryption
%APPDATA%\mail.ru\agent\mra\sounds\error.wav.flowencryption
%APPDATA%\mail.ru\agent\mra\sounds\test_sound.wav.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_away.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_busy.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_gray.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_offline.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_online.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\100.ico.flowencryption
%APPDATA%\mail.ru\agent\mra\sounds\voiceend.wav.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\skin.txt.flowencryption
%APPDATA%\mail.ru\agent\mra\sounds\call_waiting.wav.flowencryption
%APPDATA%\mail.ru\agent\mra\sounds\call_in.wav.flowencryption
%APPDATA%\mail.ru\agent\mra\sounds\busy.wav.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\mail.ru agent.lnk.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\startmenu\icq.lnk.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\startmenu\mail.ru agent.lnk.flowencryption
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\icq.lnk.flowencryption
%APPDATA%\microsoft\document building blocks\1033\14\built-in building blocks.dotx.flowencryption
%APPDATA%\mail.ru\agent\magent.exe.flowencryption
%APPDATA%\mail.ru\agent\magentsetup.exe.flowencryption
%APPDATA%\mail.ru\agent\mrainplaceviewer.dll.flowencryption
%APPDATA%\mail.ru\agent\sciter32.dll.flowencryption
%APPDATA%\mail.ru\agent\vivo.dll.flowencryption
%APPDATA%\mail.ru\agent\mra\video\video.swf.flowencryption
%APPDATA%\mail.ru\agent\mra\sounds\auth.wav.flowencryption
%APPDATA%\mail.ru\agent\libvoip_x86.dll.flowencryption
%APPDATA%\microsoft\windows\cookies\user@c.msn[2].txt.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\101.ico.flowencryption
%APPDATA%\microsoft\windows\cookies\user@c.msn[1].txt.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\mail.ru\mail.ru agent.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\mail.ru\mail.ru portal.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\mail.ru\uninstall mail.ru agent.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\icq\icq.com.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\icq\icq.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\icq\uninstall icq.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\maintenance\desktop.ini.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\maintenance\help.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\administrative tools\desktop.ini.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\accessories\notepad.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\accessories\run.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\accessories\windows explorer.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\accessories\command prompt.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\accessories\desktop.ini.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\total commander\uninstall or repair total commander.lnk.flowencryption
%APPDATA%\mirc\urls.ini.flowencryption
%APPDATA%\mirc\scripts\aliases.ini.flowencryption
%APPDATA%\mirc\scripts\popups.ini.flowencryption
%APPDATA%\microsoft\windows\start menu\desktop.ini.flowencryption
%APPDATA%\microsoft\windows\start menu\icq.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\mail.ru agent.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\qip 2012.lnk.flowencryption
%APPDATA%\mirc\servers.ini.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\desktop.ini.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\total commander\total commander 64 bit.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\total commander\total commander help.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk.flowencryption
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\crashes\store.json.mozlz4.flowencryption
%APPDATA%\microsoft\windows\cookies\user@c.bing[1].txt.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk.flowencryption
%APPDATA%\microsoft\windows\recent\customdestinations\c312e260e424ae76.customdestinations-ms.flowencryption
%APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.flowencryption
%APPDATA%\microsoft\windows\recent\automaticdestinations\74d7f43c1561fc1e.automaticdestinations-ms.flowencryption
%APPDATA%\microsoft\windows\recent\automaticdestinations\7e4dca80246863e3.automaticdestinations-ms.flowencryption
%APPDATA%\microsoft\windows\libraries\desktop.ini.flowencryption
%APPDATA%\microsoft\windows\libraries\documents.library-ms.flowencryption
%APPDATA%\microsoft\windows\recent\customdestinations\969252ce11249fdd.customdestinations-ms.flowencryption
%APPDATA%\microsoft\windows\recent\customdestinations\bf8efb871eda5262.customdestinations-ms.flowencryption
%APPDATA%\microsoft\windows\libraries\music.library-ms.flowencryption
%APPDATA%\microsoft\windows\cookies\user@246059135.log.optimizely[1].txt.flowencryption
%APPDATA%\microsoft\windows\cookies\user@adnxs[1].txt.flowencryption
%APPDATA%\microsoft\windows\cookies\user@adobe[1].txt.flowencryption
%APPDATA%\microsoft\windows\cookies\user@adobe[3].txt.flowencryption
%APPDATA%\microsoft\windows\cookies\user@bing[1].txt.flowencryption
%APPDATA%\microsoft\windows\cookies\user@bing[2].txt.flowencryption
%APPDATA%\microsoft\windows\libraries\pictures.library-ms.flowencryption
%APPDATA%\microsoft\windows\libraries\videos.library-ms.flowencryption
%APPDATA%\microsoft\windows\recent\customdestinations\9027fe24326910d2.customdestinations-ms.flowencryption
%APPDATA%\microsoft\windows\recent\customdestinations\7e4dca80246863e3.customdestinations-ms.flowencryption
%APPDATA%\microsoft\windows\recent\customdestinations\74d7f43c1561fc1e.customdestinations-ms.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk.flowencryption
%APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.flowencryption
%APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.flowencryption
%APPDATA%\microsoft\windows\sendto\desktop.ini.flowencryption
%APPDATA%\microsoft\windows\sendto\documents.mydocs.flowencryption
%APPDATA%\microsoft\windows\sendto\fax recipient.lnk.flowencryption
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk.flowencryption
%APPDATA%\microsoft\windows\sendto\mail recipient.mapimail.flowencryption
%APPDATA%\microsoft\windows\recent\desktop.ini.flowencryption
%APPDATA%\microsoft\windows\recent\customdestinations\10a2479c877ca098.customdestinations-ms.flowencryption
%APPDATA%\microsoft\windows\recent\customdestinations\1b4dd67f29cb1962.customdestinations-ms.flowencryption
%APPDATA%\microsoft\windows\recent\customdestinations\28c8b86deab549a1.customdestinations-ms.flowencryption
%APPDATA%\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms.flowencryption
%APPDATA%\microsoft\windows\recent\customdestinations\5afe4de1b92fc382.customdestinations-ms.flowencryption
%APPDATA%\microsoft\windows\recent\customdestinations\5d696d521de238c3.customdestinations-ms.flowencryption
%APPDATA%\microsoft\windows\recent\activator.lnk.flowencryption
%APPDATA%\microsoft\windows\cookies\user@c.bing[2].txt.flowencryption
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\blush.gif.flowencryption

Changes user data files extensions (Trojan.Encoder).

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial