Trojan.Encoder.31080

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'

Malicious functions

To bypass firewall, removes or modifies the following registry keys

[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)

deletes volume shadow copies.

Reads files which store third party applications passwords

%HOMEPATH%\desktop\64bit_notes.htm
%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\trivial-merge.htm

Modifies file system

Creates the following files

C:\far2\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\de\jabber\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\de\loading\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\de\error\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\cz\jabber\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\cz\loading\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\cz\error\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\bg\jabber\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\bg\loading\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\bg\error\how_to_decrypt_my_files.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\thumbnails\how_to_decrypt_my_files.txt
%LOCALAPPDATA%\microsoft\internet explorer\recovery\high\active\how_to_decrypt_my_files.txt
%LOCALAPPDATA%\google\chrome\user data\default\databases\how_to_decrypt_my_files.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\how_to_decrypt_my_files.txt
%APPDATA%\mail.ru\agent\mra\smiles\how_to_decrypt_my_files.txt
%APPDATA%\mail.ru\agent\mra\database\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\smiles\smiles\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\smiles\flash\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\graphics\phone\how_to_decrypt_my_files.txt
%APPDATA%\adobe\acrobat\dc\preferences\how_to_decrypt_my_files.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\how_to_decrypt_my_files.txt
%APPDATA%\thunderbird\profiles\wjj9aet2.default\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\en\error\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\en\jabber\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\en\loading\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\kz\error\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\smiles\smiles\emoji\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\smiles\smiles\cat\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\smiles\smiles\animated\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\smiles\smiles\8march\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\uz\loading\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\uz\jabber\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\uz\error\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\ua\loading\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\ua\jabber\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\tr\loading\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\ua\error\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\tr\error\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\tr\jabber\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\ru\loading\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\ru\jabber\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\ru\error\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\pt\loading\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\pt\jabber\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\kz\loading\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\pt\error\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\html\kz\jabber\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\how_to_decrypt_my_files.txt
%APPDATA%\opera software\opera stable\databases\how_to_decrypt_my_files.txt
%APPDATA%\microsoft\msdn\7.0\how_to_decrypt_my_files.txt
%APPDATA%\microsoft\dbgclr\7.1\how_to_decrypt_my_files.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\how_to_decrypt_my_files.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\how_to_decrypt_my_files.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\how_to_decrypt_my_files.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\how_to_decrypt_my_files.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\how_to_decrypt_my_files.txt
%HOMEPATH%\desktop\how_to_decrypt_my_files.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\how_to_decrypt_my_files.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\how_to_decrypt_my_files.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\how_to_decrypt_my_files.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\how_to_decrypt_my_files.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\how_to_decrypt_my_files.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\how_to_decrypt_my_files.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\how_to_decrypt_my_files.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\how_to_decrypt_my_files.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\how_to_decrypt_my_files.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\how_to_decrypt_my_files.txt
C:\far2\plugins\ftp\how_to_decrypt_my_files.txt
C:\far2\documentation\rus\how_to_decrypt_my_files.txt
C:\far2\documentation\eng\how_to_decrypt_my_files.txt
C:\far2\addons\how_to_decrypt_my_files.txt
C:\totalcmd\how_to_decrypt_my_files.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\how_to_decrypt_my_files.txt
C:\users\public\music\sample music\how_to_decrypt_my_files.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\how_to_decrypt_my_files.txt
C:\users\public\pictures\sample pictures\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\sounds\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\database\how_to_decrypt_my_files.txt
%LOCALAPPDATA%\google\chrome\user data\how_to_decrypt_my_files.txt
%LOCALAPPDATA%\adobe\acrobat\dc\how_to_decrypt_my_files.txt
%APPDATA%\telegram desktop\tdata\how_to_decrypt_my_files.txt
%APPDATA%\opera software\opera stable\how_to_decrypt_my_files.txt
%APPDATA%\mra\update\how_to_decrypt_my_files.txt
%APPDATA%\mail.ru\agent\how_to_decrypt_my_files.txt
%APPDATA%\icq-profile\update\how_to_decrypt_my_files.txt
%LOCALAPPDATA%\microsoft\internet explorer\how_to_decrypt_my_files.txt
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\how_to_decrypt_my_files.txt
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\how_to_decrypt_my_files.txt
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\how_to_decrypt_my_files.txt
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\how_to_decrypt_my_files.txt
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\how_to_decrypt_my_files.txt
%APPDATA%\winamp\how_to_decrypt_my_files.txt
%APPDATA%\telegram desktop\how_to_decrypt_my_files.txt
%APPDATA%\icqm\how_to_decrypt_my_files.txt
%ALLUSERSPROFILE%\microsoft\rac\statedata\how_to_decrypt_my_files.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\how_to_decrypt_my_files.txt
%ALLUSERSPROFILE%\microsoft\network\downloader\how_to_decrypt_my_files.txt
%LOCALAPPDATA%\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\smiles\how_to_decrypt_my_files.txt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\how_to_decrypt_my_files.txt

Moves the following files

from %APPDATA%\telegram desktop\log.txt to %APPDATA%\telegram desktop\log.txt.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s001.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s001.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s020.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s020.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s018.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s018.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s019.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s019.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s016.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s016.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s017.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s017.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s015.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s015.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s014.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s014.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s013.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s013.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s012.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s012.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s011.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s011.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s009.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s009.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s010.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s010.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s008.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s007.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s007.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s006.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s006.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s005.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s005.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s004.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s004.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s003.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s003.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s002.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s002.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s011.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s011.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s001.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s001.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s016.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s016.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\bullshit.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\bullshit.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s015.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s015.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s014.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s014.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s004.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s004.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s003.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s003.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\blink.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\blink.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\biggrin.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\biggrin.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\biganger.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\biganger.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\bazilio.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\bazilio.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\bee.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\bee.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\ass.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\ass.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\angry.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\angry.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\amazed.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\amazed.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\aaa.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\aaa.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s020.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s020.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s019.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s019.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s018.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s018.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s016.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s016.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s017.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s017.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s015.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s015.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s014.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s014.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s013.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s013.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s012.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s012.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s010.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s010.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s011.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s011.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s009.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s009.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s008.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s006.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s006.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\43a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\43a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s002.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s002.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\man_in_love.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\man_in_love.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\good.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\good.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\give_rose.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\give_rose.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\fool.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\fool.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\facepalm.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\facepalm.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\drinks.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\drinks.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\dirol.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\dirol.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\diablo.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\diablo.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\dance.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\dance.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\crazy.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\crazy.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\cray.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\cray.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\blush.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\blush.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\blum.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\blum.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\biggrin.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\biggrin.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\angel.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\angel.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\bad.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\bad.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\53a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\53a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\52a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\52a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\51a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\51a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\50a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\50a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\49a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\49a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\48a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\48a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\47a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\47a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\45a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\45a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s010.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s010.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s013.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s013.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s012.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s012.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\mocking.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\mocking.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\kiss_mini.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\kiss_mini.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s008.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s009.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s009.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s007.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s007.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s006.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s006.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s005.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s005.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s004.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s004.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s002.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s002.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s003.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s003.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\yahoo.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\yahoo.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s001.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s001.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\wink.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\wink.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\unknw.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\unknw.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\wacko2.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\wacko2.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\smile.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\shout.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\shout.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\shok.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\shok.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\scratch_one-s_head.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\scratch_one-s_head.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\sad.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\rolleyes.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\rolleyes.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\rofl.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\rofl.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\pardon.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\pardon.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\nea.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\nea.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\set03\music.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\music.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\46a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\46a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\coolguy.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\coolguy.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\smile.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\eat.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\eat.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\dance.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\dance.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\devil.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\devil.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\cry.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\cry.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\could.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\could.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\blew.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\blew.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\book.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\book.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\beauty.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\beauty.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\beer.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\beer.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\angel.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\angel.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\appl.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\appl.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\sunburn.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\sunburn.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\shoes.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\shoes.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\ring.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\ring.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\perfume.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\perfume.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\new_dress.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\new_dress.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\mad.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\mad.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\love.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\love.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\joy.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\joy.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\flowers.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\flowers.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\hug.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\hug.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\drink.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\drink.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\doll.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\doll.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\cat.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\cat.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\cookie.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\cookie.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\fingal.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\fingal.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\fight.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\fight.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_meow.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_meow.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_lick.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_lick.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_hand.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_hand.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_attack.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_attack.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\wonder.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\wonder.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\victory.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\victory.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\tongue.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\tongue.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\smile.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\smile.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\sleep.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\sleep.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\skuka.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\skuka.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\sing.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\sing.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\red.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\red.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\gamer.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\gamer.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\rainbow.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\rainbow.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\poison.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\poison.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\pistolet.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\pistolet.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\love.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\love.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\hungry.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\hungry.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\kiss.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\kiss.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\history.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\history.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\gift.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\gift.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\gg2.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\gg2.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\gg.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\gg.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\flowr.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\flowr.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\crocodile.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\crocodile.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\cry.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\cry.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\html\ua\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\ua\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\html\uz\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\uz\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\shy.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\shy.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\sceptic.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\sceptic.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\rrr.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\rrr.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\plug.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\plug.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\really.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\really.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\pig.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\pig.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\oo.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\oo.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\ok.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\ok.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\live.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\live.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\laughter.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\laughter.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\kukes.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\kukes.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\hm.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\hm.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_right.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_right.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_left.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_left.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\kiss.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\fuck.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\fuck.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\heart.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\heart.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\disappointed.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\disappointed.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\fist.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\fist.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\die.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\die.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\detzl.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\detzl.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\devil.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\devil.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\sleepy.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\sleepy.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\car.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\car.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\tears.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\tears.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\think.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\think.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\victory.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\victory.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\html\ru\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\ru\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\html\pt\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\pt\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\html\kz\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\kz\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\html\en\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\en\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\html\de\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\de\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\html\cz\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\cz\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\html\bg\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\bg\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\webapps.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\webapps.json.ragnarok_cry
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\state.json.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\s008.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\s008.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\want_you.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\want_you.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\undress.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\undress.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\lets_play.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\lets_play.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\on_wings.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\on_wings.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\kissed.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\kissed.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\jealousy.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\jealousy.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\kiss.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\in_love.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\in_love.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\dont_be_late.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\dont_be_late.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\broken_heart.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\broken_heart.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\zloradstvo.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\zloradstvo.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\vampire.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\vampire.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\html\tr\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\tr\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\44a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\44a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\42a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\42a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\41b.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\41b.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\devil.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\devil.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\dance.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\dance.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\could.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\could.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\book.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\book.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\8march\love.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\love.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\fight.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\fight.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_paper.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_paper.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_mouse.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_mouse.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_meow.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_meow.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_lick.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_lick.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_hand.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_hand.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_attack.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_attack.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\wonder.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\wonder.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\tongue.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\tongue.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\victory.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\victory.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\sleep.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sleep.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\smile.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\skuka.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\skuka.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\sing.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sing.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\red.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\red.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sad.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\rainbow.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\rainbow.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\poison.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\poison.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\pistolet.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\pistolet.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\love.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\love.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\kiss.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\hungry.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\hungry.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\history.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\history.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\gift.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gift.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\gg2.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gg2.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\flowr.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\flowr.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\fingal.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\fingal.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\gg.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gg.gif.ragnarok_cry
from %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\database\citylist_kz.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_kz.csv.ragnarok_cry
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.json.ragnarok_cry
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\foldertree.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\foldertree.json.ragnarok_cry
from %APPDATA%\icqm\icq\sounds\ring.mp3 to %APPDATA%\icqm\icq\sounds\ring.mp3.ragnarok_cry
from %APPDATA%\icqm\icq\sounds\otprav.mp3 to %APPDATA%\icqm\icq\sounds\otprav.mp3.ragnarok_cry
from %APPDATA%\icqm\icq\sounds\conference.mp3 to %APPDATA%\icqm\icq\sounds\conference.mp3.ragnarok_cry
from %APPDATA%\icqm\icq\sounds\message.mp3 to %APPDATA%\icqm\icq\sounds\message.mp3.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\skin.txt to %APPDATA%\icqm\icq\smiles\skin.txt.ragnarok_cry
from %APPDATA%\icqm\icq\sounds\busy.mp3 to %APPDATA%\icqm\icq\sounds\busy.mp3.ragnarok_cry
from %APPDATA%\icqm\icq\sounds\auth.mp3 to %APPDATA%\icqm\icq\sounds\auth.mp3.ragnarok_cry
from %APPDATA%\icqm\icq\database\citylist_uz.csv to %APPDATA%\icqm\icq\database\citylist_uz.csv.ragnarok_cry
from %APPDATA%\icqm\icq\database\citylist_ua.csv to %APPDATA%\icqm\icq\database\citylist_ua.csv.ragnarok_cry
from %APPDATA%\icqm\icq\database\citylist_tr.csv to %APPDATA%\icqm\icq\database\citylist_tr.csv.ragnarok_cry
from %APPDATA%\icqm\icq\database\citylist_ru.csv to %APPDATA%\icqm\icq\database\citylist_ru.csv.ragnarok_cry
from %APPDATA%\icqm\icq\database\citylist_kz.csv to %APPDATA%\icqm\icq\database\citylist_kz.csv.ragnarok_cry
from %APPDATA%\icqm\icq\database\citylist_en.csv to %APPDATA%\icqm\icq\database\citylist_en.csv.ragnarok_cry
from %APPDATA%\telegram desktop\tdata\shortcuts-default.json to %APPDATA%\telegram desktop\tdata\shortcuts-default.json.ragnarok_cry
from %APPDATA%\opera software\opera stable\update_prefs.json to %APPDATA%\opera software\opera stable\update_prefs.json.ragnarok_cry
from %APPDATA%\telegram desktop\tdata\shortcuts-custom.json to %APPDATA%\telegram desktop\tdata\shortcuts-custom.json.ragnarok_cry
from %APPDATA%\opera software\opera stable\siteprefs.json to %APPDATA%\opera software\opera stable\siteprefs.json.ragnarok_cry
from %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt to %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt.ragnarok_cry
from %APPDATA%\opera software\opera stable\bookmarks.bak to %APPDATA%\opera software\opera stable\bookmarks.bak.ragnarok_cry
from %APPDATA%\winamp\demo.mp3 to %APPDATA%\winamp\demo.mp3.ragnarok_cry
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\sessioncheckpoints.json.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\8march\car.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\car.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\angel.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\angel.gif.ragnarok_cry
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\session.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\session.json.ragnarok_cry
from %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif.ragnarok_cry
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\xulstore.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\xulstore.json.ragnarok_cry
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\times.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\times.json.ragnarok_cry
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sitesecurityservicestate.txt.ragnarok_cry
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessioncheckpoints.json.ragnarok_cry
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\search.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\search.json.ragnarok_cry
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\revocations.txt to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\revocations.txt.ragnarok_cry
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.json.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\skin.txt to %APPDATA%\mail.ru\agent\mra\smiles\skin.txt.ragnarok_cry
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\addons.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\addons.json.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\database\citylist_uz.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_uz.csv.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\database\citylist_ua.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_ua.csv.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\database\citylist_tr.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_tr.csv.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\database\citylist_ru.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_ru.csv.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\database\citylist_en.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_en.csv.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\s008.gif.ragnarok_cry
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\times.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\times.json.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\animated\eat.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\eat.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blinking.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blinking.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\11a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\11a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\nea.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\nea.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\10a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\10a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\09a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\09a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\08a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\08a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\07a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\07a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\06a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\06a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\04b.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\04b.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\03a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\03a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\02.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\02.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\yes.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\yes.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\01.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\01.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\yahoo.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\yahoo.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\wink.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\wink.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\unknown.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\unknown.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\wacko1.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\wacko1.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\sorry.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\sorry.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\smile.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\shok.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\shok.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\shout.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\shout.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\scratch_one-s_head.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\scratch_one-s_head.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\sad.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\pardon.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\pardon.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\rofl.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\rofl.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\mocking.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\mocking.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\12a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\12a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\13a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\13a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\14a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\14a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\15a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\15a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\39a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\39a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\38a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\38a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\37.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\37.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\36a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\36a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\34a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\34a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\32a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\32a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\33a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\33a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\31a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\31a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\30a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\30a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\29a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\29a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\28a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\28a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\27a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\27a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\26a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\26a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\25a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\25a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\24a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\24a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\23a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\23a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\21a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\21a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\22a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\22a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\20a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\20a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\19a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\19a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\17a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\17a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\16a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\16a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\40a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\40a.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\music.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\music.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\man_in_love.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\man_in_love.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blushing.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blushing.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\surprised.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\surprised.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\stop.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\stop.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\smile.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\scream.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\scream.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\sad.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\nothing to say.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\nothing to say.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\mad.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\mad.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\listening to music.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\listening to music.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing out loud (lol).gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing out loud (lol).gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissing.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissing.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissed.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissed.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kiss.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\gross.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\gross.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\in love.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\in love.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\falling asleep.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\falling asleep.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\drinking.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\drinking.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\devil.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\devil.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\crying.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\crying.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\cool.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\cool.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\can't say-shut up.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\can't say-shut up.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\bomb.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\bomb.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thumbs up.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thumbs up.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\tongue out.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\tongue out.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thank you.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thank you.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\air_kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\air_kiss.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\mad.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\mad.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\bad.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\bad.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\lol.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\lol.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss3.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss3.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\ireful.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\ireful.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\i_am_so_happy.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\i_am_so_happy.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\hi.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\hi.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\hang1.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\hang1.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\good.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\good.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_rose.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_rose.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\girl_angel.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\girl_angel.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\sad.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\sad.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_mouse.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_mouse.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\drinks.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\drinks.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\dance.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\dance.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\diablo.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\diablo.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\cry.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\cry.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\crazy.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\crazy.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\bye2.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\bye2.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\cool.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\cool.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\bomb.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\bomb.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\blush.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\blush.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\blum1.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\blum1.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\biggrin.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\biggrin.gif.ragnarok_cry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_heart.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_heart.gif.ragnarok_cry
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_paper.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_paper.gif.ragnarok_cry

Modifies the following files

C:\far2\restoresettings.cmd
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab
C:\far2\plugins\ftp\notes.txt
C:\far2\plugins\ftp\notes_rus.txt
C:\far2\plugins\ftp\ftpcmds.txt
C:\far2\plugins\ftp\ftpcmds_rus.txt
C:\far2\documentation\rus\techinfo.txt
C:\far2\documentation\rus\plugins_review.txt
C:\far2\documentation\rus\plugins_install.txt
C:\far2\documentation\rus\far_faq.txt
C:\far2\documentation\rus\bug_report.txt
C:\far2\documentation\eng\techinfo.txt
C:\far2\documentation\rus\arc_support.txt
C:\far2\documentation\eng\plugins_review.txt
C:\far2\documentation\eng\plugins_install.txt
C:\far2\documentation\eng\bug_report.txt
C:\far2\documentation\eng\far_faq.txt
C:\far2\documentation\eng\arc_support.txt
C:\far2\addons\readme.txt
C:\totalcmd\size!.txt
C:\totalcmd\register.rtf
C:\totalcmd\keyboard.txt
C:\totalcmd\history.txt
C:\far2\savesettings.cmd
C:\far2\clearpluginscache.cmd
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\pptlr.cab
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publr.cab

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet' (with hidden window)
'<SYSTEM32>\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh advfirewall set allprofiles state off' (with hidden window)
'<SYSTEM32>\cmd.exe' /c bcdedit /set {current} recoveryenabled no' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet
'<SYSTEM32>\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c netsh advfirewall set allprofiles state off
'<SYSTEM32>\cmd.exe' /c bcdedit /set {current} recoveryenabled no
'<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off
'<SYSTEM32>\bcdedit.exe' /set {current} bootstatuspolicy ignoreallfailures

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial