Trojan.Encoder.34641

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '홧홇홵혺홳혶혼홇홥혴홐홴홥홈호' = '%CommonProgramFiles%\System\偟倮偐倳倪倭偛倳倳倫倭倮偞偛倪\svchost.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'BrowserUpdateCheck' = '%LOCALAPPDATA%\<File name>.exe'

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Defender

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%CommonProgramFiles%\System\偟倮偐倳倪倭偛倳倳倫倭倮偞偛倪\svchost.exe' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Full path to file>' = '00000000'

Reads files which store third party applications passwords

%HOMEPATH%\desktop\508softwareandos.doc
%APPDATA%\thunderbird\profiles.ini
%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\join.avi
%APPDATA%\opera software\opera stable\login data
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%APPDATA%\mozilla\firefox\profiles.ini

Modifies file system

Creates the following files

%CommonProgramFiles%\system\偟倮偐倳倪倭偛倳倳倫倭倮偞偛倪\svchost.exe
%APPDATA%\mirc\read-me.txt
%APPDATA%\mozilla\firefox\crash reports\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\bookmarkbackups\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\crashes\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.3\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\read-me.txt
%APPDATA%\mail.ru\agent\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\read-me.txt
%APPDATA%\mozilla\firefox\read-me.txt
%APPDATA%\mra\base\read-me.txt
%APPDATA%\mra\update\read-me.txt
%APPDATA%\mra\read-me.txt
%APPDATA%\opera software\opera stable\databases\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\idb\read-me.txt
%APPDATA%\telegram desktop\read-me.txt
%APPDATA%\mail.ru\agent\mra\video\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\static_png\read-me.txt
%APPDATA%\opera software\opera stable\dictionaries\read-me.txt
%APPDATA%\mirc\scripts\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\read-me.txt
%APPDATA%\mail.ru\agent\mra\sounds\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\read-me.txt
%APPDATA%\mail.ru\agent\mra\translation\read-me.txt
%APPDATA%\opera software\opera stable\extension state\read-me.txt
%APPDATA%\opera software\opera stable\jump list icons\read-me.txt
%APPDATA%\opera software\opera stable\jump list iconsold\read-me.txt
%HOMEPATH%\videos\read-me.txt
%HOMEPATH%\favorites\msn websites\read-me.txt
%HOMEPATH%\favorites\windows live\read-me.txt
%HOMEPATH%\favorites\read-me.txt
%HOMEPATH%\links\read-me.txt
%HOMEPATH%\music\read-me.txt
%HOMEPATH%\pictures\read-me.txt
%HOMEPATH%\saved games\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\read-me.txt
%HOMEPATH%\favorites\links for united states\read-me.txt
%HOMEPATH%\read-me.txt
C:\users\read-me.txt
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\read-me.txt
D:\read-me.txt
C:\users\public\8d9e927358f0e450365f21c7cbb7996edff5c6f92a853e877e85154f384b2ad7
%LOCALAPPDATA%\<File name>.exe
%TEMP%\c12bc342-0581-4229-9ee3-89b4fbfed447\test.bat
%TEMP%\c12bc342-0581-4229-9ee3-89b4fbfed447\advancedrun.exe
%HOMEPATH%\searches\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\read-me.txt
%HOMEPATH%\favorites\links\read-me.txt
%HOMEPATH%\desktop\read-me.txt
%HOMEPATH%\downloads\read-me.txt
%APPDATA%\opera software\opera stable\local storage\read-me.txt
%APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\read-me.txt
%APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\read-me.txt
%APPDATA%\opera software\opera stable\storage\ext\sync-login\def\read-me.txt
%APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\read-me.txt
%APPDATA%\opera software\opera stable\read-me.txt
%APPDATA%\qipguard\read-me.txt
%HOMEPATH%\documents\read-me.txt
%APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\read-me.txt
%HOMEPATH%\favorites\microsoft websites\read-me.txt
%APPDATA%\thunderbird\crash reports\read-me.txt
%APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\read-me.txt
%APPDATA%\thunderbird\profiles\wjj9aet2.default\read-me.txt
%APPDATA%\thunderbird\read-me.txt
%APPDATA%\winamp\plugins\milkdrop2\read-me.txt
%APPDATA%\winamp\read-me.txt
%HOMEPATH%\contacts\read-me.txt
%APPDATA%\telegram desktop\tdata\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\emoji\read-me.txt

Deletes the following files

%TEMP%\c12bc342-0581-4229-9ee3-89b4fbfed447\advancedrun.exe
%TEMP%\c12bc342-0581-4229-9ee3-89b4fbfed447\test.bat

Moves the following files

from %APPDATA%\winamp\demo.mp3 to %APPDATA%\winamp\demo.mp3.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s012.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s012.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s013.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s013.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s014.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s014.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s015.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s015.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s016.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s016.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\angel.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\angel.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\bad.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\bad.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\biggrin.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\biggrin.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\good.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\good.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s011.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s011.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s010.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s010.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\crazy.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\crazy.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\dance.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\dance.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\diablo.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\diablo.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\dirol.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\dirol.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\drinks.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\drinks.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\facepalm.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\facepalm.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\fool.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\fool.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\give_rose.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\give_rose.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\blum.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\blum.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\cray.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\cray.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\33a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\33a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\blush.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\blush.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s017.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s017.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s008.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s008.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s009.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s009.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s010.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s010.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s011.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s011.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s012.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s012.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s013.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s013.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s014.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s014.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s015.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s015.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s007.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s007.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s009.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s009.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s008.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s008.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s019.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s019.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s020.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s020.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s001.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s001.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s002.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s002.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s003.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s003.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s004.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s004.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s005.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s005.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s006.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s006.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s016.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s016.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s018.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s018.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s007.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s007.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s006.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s006.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\music.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\music.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\13a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\13a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\14a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\14a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\15a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\15a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\16a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\16a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\17a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\17a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\19a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\19a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\20a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\20a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\21a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\21a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\man_in_love.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\man_in_love.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\12a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\12a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\11a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\11a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\25a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\25a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\26a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\26a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\27a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\27a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\28a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\28a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\29a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\29a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\30a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\30a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\31a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\31a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\32a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\32a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\22a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\22a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\24a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\24a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\mocking.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\mocking.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\23a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\23a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\kiss_mini.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\kiss_mini.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\nea.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\nea.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\pardon.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\pardon.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\rofl.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\rofl.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\rolleyes.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\rolleyes.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\sad.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\sad.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\scratch_one-s_head.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\scratch_one-s_head.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\shok.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\shok.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\shout.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\shout.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\08a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\08a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\10a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\10a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\09a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\09a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\wink.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\wink.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\yahoo.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\yahoo.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\01.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\01.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\02.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\02.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\03a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\03a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\04b.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\04b.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\06a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\06a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\07a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\07a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\smile.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\smile.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\wacko2.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\wacko2.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_connecting.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_connecting.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\unknw.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\unknw.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\oo.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\oo.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\kissed.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\kissed.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\lets_play.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\lets_play.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\on_wings.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\on_wings.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\undress.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\undress.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\want_you.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\want_you.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\aaa.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\aaa.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\amazed.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\amazed.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\angry.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\angry.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\devil.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\devil.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\kiss.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\kiss.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\jealousy.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\jealousy.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\biganger.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\biganger.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\biggrin.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\biggrin.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\blink.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\blink.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\bullshit.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\bullshit.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\coolguy.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\coolguy.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\crocodile.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\crocodile.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\cry.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\cry.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\detzl.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\detzl.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\ass.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\ass.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\bee.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\bee.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s003.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s003.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\bazilio.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\bazilio.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_busy.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_busy.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_gray.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_gray.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_invisible.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_invisible.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_offline.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_offline.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_online.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_online.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_wrong_data.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_wrong_data.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\seekfriends.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\seekfriends.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\seekfriends_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\seekfriends_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\status_mobile.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\status_mobile.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\broken_heart.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\broken_heart.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\in_love.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\in_love.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\dont_be_late.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\dont_be_late.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_offline.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_offline.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_online.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_online.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_away.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_away.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_busy.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_busy.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_gray.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_gray.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_offline.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_offline.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_online.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_online.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\s008.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\s008.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_away.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_away.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_gray.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_gray.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s005.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s005.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s004.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s004.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\fuck.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\fuck.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s002.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s002.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s003.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s003.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s004.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s004.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s006.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s006.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s008.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s008.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s009.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s009.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s010.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s010.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s011.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s011.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\disappointed.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\disappointed.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s001.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s001.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\zloradstvo.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\zloradstvo.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s015.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s015.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s016.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s016.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s017.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s017.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s018.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s018.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s019.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s019.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s020.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s020.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s001.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s001.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s002.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s002.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s012.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s012.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s014.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s014.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\fist.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\fist.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s013.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s013.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\die.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\die.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\heart.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\heart.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\hm.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\hm.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\kiss.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\kiss.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\koza_left.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\koza_left.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\koza_right.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\koza_right.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\kukes.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\kukes.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\laughter.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\laughter.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\live.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\live.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\think.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\think.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\victory.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\victory.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\vampire.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\vampire.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\plug.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\plug.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\really.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\really.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\rrr.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\rrr.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\sceptic.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\sceptic.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\shy.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\shy.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\sleepy.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\sleepy.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\smile.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\smile.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\tears.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\tears.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\ok.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\ok.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\pig.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\pig.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_dnd.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_dnd.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\34a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\34a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\39a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\39a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\sleep.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\sleep.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\smile.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\smile.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\tongue.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\tongue.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\victory.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\victory.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\wonder.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\wonder.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\car.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\car.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\cat.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\cat.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\cookie.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\cookie.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\sunburn.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\sunburn.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\skuka.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\skuka.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\sing.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\sing.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\hug.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\hug.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\joy.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\joy.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\love.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\love.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\mad.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\mad.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\new_dress.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\new_dress.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\perfume.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\perfume.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\ring.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\ring.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\shoes.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\shoes.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\doll.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\doll.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\flowers.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\flowers.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\beauty.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\beauty.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\drink.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\drink.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\flowr.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\flowr.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\blew.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\blew.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\book.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\book.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\could.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\could.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\cry.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\cry.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\dance.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\dance.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\devil.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\devil.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\eat.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\eat.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\fight.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\fight.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\rainbow.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\rainbow.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\sad.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\sad.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\red.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\red.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\gg2.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\gg2.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\gift.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\gift.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\history.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\history.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\hungry.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\hungry.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\kiss.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\kiss.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\love.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\love.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\pistolet.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\pistolet.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\poison.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\poison.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\fingal.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\fingal.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\gg.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\gg.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\beer.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\beer.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\akitaka.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\akitaka.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\beer.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\beer.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\krizis.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\krizis.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\laugh.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\laugh.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\likeu.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\likeu.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\love_bear_hugs.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\love_bear_hugs.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\love_bear_kiss.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\love_bear_kiss.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\love_bear_rose.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\love_bear_rose.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\mad dog.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\mad dog.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\missyou.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\missyou.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_spasibo.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_spasibo.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_wow.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_wow.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\rabotaet.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\rabotaet.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\skratch.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\skratch.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\smeh.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\smeh.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\sobaka.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\sobaka.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\sobaka_strelyaet.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\sobaka_strelyaet.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\sorry.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\sorry.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\tank.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\tank.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\wf_love_sdaus.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\wf_love_sdaus.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\wf_love_srazila.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\wf_love_srazila.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\rosy.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\rosy.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\serdze.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\serdze.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\bad_cold.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\bad_cold.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\angel.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\angel.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_goodbye.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_goodbye.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\bodun.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\bodun.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\boo.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\boo.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\canthearu.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\canthearu.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\chillout.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\chillout.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\devochka.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\devochka.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_bolnoy.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_bolnoy.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_koster.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_koster.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_nedutza.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_nedutza.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\beback.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\beback.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_obida.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_obida.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_love.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_love.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\duh.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\duh.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\gangsta.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\gangsta.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\guby.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\guby.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\information.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\information.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\joy.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\joy.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\kisses.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kisses.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_cool.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_cool.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_opyatnica.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_opyatnica.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_snegyrka.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_snegyrka.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_zombie.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_zombie.swf.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\37.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\37.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\36a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\36a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_paper.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_paper.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\dance.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\dance.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\diablo.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\diablo.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\drinks.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\drinks.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\gamer.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\gamer.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\girl_angel.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\girl_angel.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\give_heart.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\give_heart.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\give_rose.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\give_rose.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\cool.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\cool.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\bye2.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\bye2.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\cry.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\cry.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\good.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\good.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\i_am_so_happy.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\i_am_so_happy.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\kiss.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\kiss.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\kiss3.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\kiss3.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\lol.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\lol.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\mad.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\mad.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\man_in_love.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\man_in_love.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\mocking.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\mocking.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\hang1.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\hang1.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\hi.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\hi.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\ireful.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\ireful.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\crazy.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\crazy.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\music.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\music.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\angel.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\angel.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\40a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\40a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\41b.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\41b.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\42a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\42a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\43a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\43a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\44a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\44a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\45a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\45a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\46a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\46a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\bomb.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\bomb.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\38a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\38a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\blush.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\blush.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\47a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\47a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\51a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\51a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\52a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\52a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\53a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\53a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\air_kiss.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\air_kiss.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\bad.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\bad.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\biggrin.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\biggrin.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\blum1.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\blum1.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\48a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\48a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\49a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\49a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\50a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\50a.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\appl.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\appl.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\nea.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\nea.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\scratch_one-s_head.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\scratch_one-s_head.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\laughing out loud (lol).gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\laughing out loud (lol).gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\laughing.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\laughing.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\listening to music.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\listening to music.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\mad.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\mad.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\nothing to say.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\nothing to say.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\sad.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\sad.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\scream.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\scream.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\kiss.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\kiss.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\in love.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\in love.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\kissing.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\kissing.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\smile.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\smile.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\thumbs up.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\thumbs up.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\tongue out.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\tongue out.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_attack.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_attack.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_hand.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_hand.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_lick.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_lick.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_meow.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_meow.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_mouse.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_mouse.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\stop.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\stop.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\surprised.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\surprised.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\thank you.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\thank you.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\kissed.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\kissed.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\pardon.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\pardon.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\rofl.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\rofl.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\shok.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\shok.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\shout.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\shout.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\smile.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\smile.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\sorry.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\sorry.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\unknown.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\unknown.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\wacko1.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\wacko1.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\wink.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\wink.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\gross.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\gross.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\sad.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\sad.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\falling asleep.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\falling asleep.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\yahoo.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\yahoo.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\blushing.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\blushing.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\bomb.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\bomb.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\can't say-shut up.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\can't say-shut up.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\cool.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\cool.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\crying.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\crying.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\devil.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\devil.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\drinking.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\drinking.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\yes.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\yes.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\angel.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\angel.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\blinking.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\blinking.gif.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_chat.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_chat.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_away.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_away.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\24bit.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\24bit.ico.xls
from %APPDATA%\mra\update\languages.hash to %APPDATA%\mra\update\languages.hash.xls
from %APPDATA%\mra\update\ver.txt to %APPDATA%\mra\update\ver.txt.xls
from %APPDATA%\mra\base\mra.dbs to %APPDATA%\mra\base\mra.dbs.xls
from %APPDATA%\mra\base\opt.dbs to %APPDATA%\mra\base\opt.dbs.xls
from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\addons.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\addons.json.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\compatibility.ini.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.ini to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.ini.xls
from %APPDATA%\mra\update\languages.aff to %APPDATA%\mra\update\languages.aff.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\.metadata to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\.metadata.xls
from %APPDATA%\opera software\opera stable\databases\databases.db-journal to %APPDATA%\opera software\opera stable\databases\databases.db-journal.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\revocations.txt to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\revocations.txt.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\search.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\search.json.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessioncheckpoints.json.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sitesecurityservicestate.txt.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\times.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\times.json.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\user.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\user.js.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\xulstore.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\xulstore.json.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\webapps.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\webapps.json.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\healthreport.sqlite to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\healthreport.sqlite.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.json.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js.xls
from %APPDATA%\opera software\opera stable\extension state\log.old to %APPDATA%\opera software\opera stable\extension state\log.old.xls
from %APPDATA%\opera software\opera stable\jump list icons\51ce.tmp to %APPDATA%\opera software\opera stable\jump list icons\51ce.tmp.xls
from %APPDATA%\opera software\opera stable\jump list iconsold\3651.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3651.tmp.xls
from %APPDATA%\opera software\opera stable\jump list iconsold\36a1.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\36a1.tmp.xls
from %APPDATA%\opera software\opera stable\jump list iconsold\36c3.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\36c3.tmp.xls
from %APPDATA%\opera software\opera stable\jump list iconsold\3703.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3703.tmp.xls
from %APPDATA%\opera software\opera stable\jump list iconsold\3724.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3724.tmp.xls
from %APPDATA%\opera software\opera stable\jump list iconsold\3765.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3765.tmp.xls
from %APPDATA%\opera software\opera stable\jump list iconsold\3796.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3796.tmp.xls
from %APPDATA%\opera software\opera stable\jump list icons\50ed.tmp to %APPDATA%\opera software\opera stable\jump list icons\50ed.tmp.xls
from %APPDATA%\opera software\opera stable\extension state\manifest-000001 to %APPDATA%\opera software\opera stable\extension state\manifest-000001.xls
from %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage to %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage.xls
from %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage-journal.xls
from %APPDATA%\opera software\opera stable\jump list icons\51ff.tmp to %APPDATA%\opera software\opera stable\jump list icons\51ff.tmp.xls
from %APPDATA%\opera software\opera stable\jump list icons\524f.tmp to %APPDATA%\opera software\opera stable\jump list icons\524f.tmp.xls
from %APPDATA%\opera software\opera stable\jump list icons\529f.tmp to %APPDATA%\opera software\opera stable\jump list icons\529f.tmp.xls
from %APPDATA%\opera software\opera stable\extension state\000003.ldb to %APPDATA%\opera software\opera stable\extension state\000003.ldb.xls
from %APPDATA%\opera software\opera stable\extension state\000006.ldb to %APPDATA%\opera software\opera stable\extension state\000006.ldb.xls
from %APPDATA%\opera software\opera stable\extension state\000007.log to %APPDATA%\opera software\opera stable\extension state\000007.log.xls
from %APPDATA%\opera software\opera stable\extension state\current to %APPDATA%\opera software\opera stable\extension state\current.xls
from %APPDATA%\opera software\opera stable\extension state\log to %APPDATA%\opera software\opera stable\extension state\log.xls
from %APPDATA%\opera software\opera stable\jump list icons\516e.tmp to %APPDATA%\opera software\opera stable\jump list icons\516e.tmp.xls
from %APPDATA%\opera software\opera stable\jump list icons\514d.tmp to %APPDATA%\opera software\opera stable\jump list icons\514d.tmp.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\101_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\101_xp.ico.xls
from %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage-journal.xls
from %APPDATA%\mail.ru\agent\mra\sounds\call_waiting.wav to %APPDATA%\mail.ru\agent\mra\sounds\call_waiting.wav.xls
from %APPDATA%\mail.ru\agent\mra\sounds\conference.wav to %APPDATA%\mail.ru\agent\mra\sounds\conference.wav.xls
from %APPDATA%\mail.ru\agent\mra\sounds\error.wav to %APPDATA%\mail.ru\agent\mra\sounds\error.wav.xls
from %APPDATA%\mail.ru\agent\mra\sounds\letter.wav to %APPDATA%\mail.ru\agent\mra\sounds\letter.wav.xls
from %APPDATA%\mail.ru\agent\mra\sounds\message.wav to %APPDATA%\mail.ru\agent\mra\sounds\message.wav.xls
from %APPDATA%\mail.ru\agent\mra\sounds\no_answer.wav to %APPDATA%\mail.ru\agent\mra\sounds\no_answer.wav.xls
from %APPDATA%\mail.ru\agent\mra\sounds\otprav.wav to %APPDATA%\mail.ru\agent\mra\sounds\otprav.wav.xls
from %APPDATA%\mail.ru\agent\mra\sounds\ring.wav to %APPDATA%\mail.ru\agent\mra\sounds\ring.wav.xls
from %APPDATA%\mail.ru\agent\mra\sounds\start.wav to %APPDATA%\mail.ru\agent\mra\sounds\start.wav.xls
from %APPDATA%\mail.ru\agent\mra\sounds\call_in.wav to %APPDATA%\mail.ru\agent\mra\sounds\call_in.wav.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\previous.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\previous.js.xls
from %APPDATA%\mail.ru\agent\mra\sounds\busy.wav to %APPDATA%\mail.ru\agent\mra\sounds\busy.wav.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_away.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_away.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_busy.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_busy.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_gray.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_gray.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_offline.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_offline.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_online.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_online.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\100.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\100.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\100_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\100_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\101.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\101.ico.xls
from %APPDATA%\mail.ru\agent\mra\sounds\voiceend.wav to %APPDATA%\mail.ru\agent\mra\sounds\voiceend.wav.xls
from %APPDATA%\mail.ru\agent\mra\sounds\test_sound.wav to %APPDATA%\mail.ru\agent\mra\sounds\test_sound.wav.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite.xls
from %APPDATA%\mail.ru\agent\mra\video\video.swf to %APPDATA%\mail.ru\agent\mra\video\video.swf.xls
from %APPDATA%\mirc\urls.ini to %APPDATA%\mirc\urls.ini.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\gmpopenh264.dll to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\gmpopenh264.dll.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\gmpopenh264.info to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\gmpopenh264.info.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.3\gmpopenh264.dll to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.3\gmpopenh264.dll.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.3\gmpopenh264.info to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.3\gmpopenh264.info.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\state.json.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\crashes\store.json.mozlz4.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\bookmarkbackups\bookmarks-2021-11-10_14_x5qkry9yysawyostzmcdfa==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\bookmarkbackups\bookmarks-2021-11-10_14_x5qkry9yysawyostzmcdfa==.jsonlz4.xls
from %APPDATA%\mozilla\firefox\crash reports\installtime20150415140819 to %APPDATA%\mozilla\firefox\crash reports\installtime20150415140819.xls
from %APPDATA%\mail.ru\agent\mra\sounds\auth.wav to %APPDATA%\mail.ru\agent\mra\sounds\auth.wav.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\recovery.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\recovery.js.xls
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\upgrade.js-20150415140819 to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\upgrade.js-20150415140819.xls
from %APPDATA%\mirc\scripts\aliases.ini to %APPDATA%\mirc\scripts\aliases.ini.xls
from %APPDATA%\mirc\scripts\popups.ini to %APPDATA%\mirc\scripts\popups.ini.xls
from %APPDATA%\mail.ru\agent\libvoip_x86.dll to %APPDATA%\mail.ru\agent\libvoip_x86.dll.xls
from %APPDATA%\mail.ru\agent\magent.exe to %APPDATA%\mail.ru\agent\magent.exe.xls
from %APPDATA%\mail.ru\agent\magentsetup.exe to %APPDATA%\mail.ru\agent\magentsetup.exe.xls
from %APPDATA%\mail.ru\agent\mrainplaceviewer.dll to %APPDATA%\mail.ru\agent\mrainplaceviewer.dll.xls
from %APPDATA%\mail.ru\agent\sciter32.dll to %APPDATA%\mail.ru\agent\sciter32.dll.xls
from %APPDATA%\mail.ru\agent\vivo.dll to %APPDATA%\mail.ru\agent\vivo.dll.xls
from %APPDATA%\mirc\servers.ini to %APPDATA%\mirc\servers.ini.xls
from %APPDATA%\mirc\mirc.ini to %APPDATA%\mirc\mirc.ini.xls
from %APPDATA%\mail.ru\agent\mra\smiles\skin.txt to %APPDATA%\mail.ru\agent\mra\smiles\skin.txt.xls
from %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage-journal.xls
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\quotamanager to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\quotamanager.xls
from %APPDATA%\telegram desktop\unins000.exe to %APPDATA%\telegram desktop\unins000.exe.xls
from %APPDATA%\telegram desktop\updater.exe to %APPDATA%\telegram desktop\updater.exe.xls
from %APPDATA%\telegram desktop\tdata\90ef50e22e92cb8c0 to %APPDATA%\telegram desktop\tdata\90ef50e22e92cb8c0.xls
from %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c1 to %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c1.xls
from %APPDATA%\telegram desktop\tdata\prefix to %APPDATA%\telegram desktop\tdata\prefix.xls
from %APPDATA%\telegram desktop\tdata\settings0 to %APPDATA%\telegram desktop\tdata\settings0.xls
from %APPDATA%\telegram desktop\tdata\shortcuts-custom.json to %APPDATA%\telegram desktop\tdata\shortcuts-custom.json.xls
from %APPDATA%\telegram desktop\tdata\shortcuts-default.json to %APPDATA%\telegram desktop\tdata\shortcuts-default.json.xls
from %APPDATA%\telegram desktop\log.txt to %APPDATA%\telegram desktop\log.txt.xls
from %APPDATA%\opera software\opera stable\certificate revocation lists to %APPDATA%\opera software\opera stable\certificate revocation lists.xls
from %APPDATA%\thunderbird\crash reports\installtime20150330093429 to %APPDATA%\thunderbird\crash reports\installtime20150330093429.xls
from %APPDATA%\qipguard\chrome.dll to %APPDATA%\qipguard\chrome.dll.xls
from %APPDATA%\qipguard\qipguard.exe to %APPDATA%\qipguard\qipguard.exe.xls
from %APPDATA%\qipguard\qipguard_upd.exe to %APPDATA%\qipguard\qipguard_upd.exe.xls
from %APPDATA%\qipguard\sqlite3.dll to %APPDATA%\qipguard\sqlite3.dll.xls
from %APPDATA%\opera software\opera stable\bookmarks to %APPDATA%\opera software\opera stable\bookmarks.xls
from %APPDATA%\opera software\opera stable\bookmarks.bak to %APPDATA%\opera software\opera stable\bookmarks.bak.xls
from %APPDATA%\opera software\opera stable\bookmarksextras to %APPDATA%\opera software\opera stable\bookmarksextras.xls
from %APPDATA%\opera software\opera stable\browser.js to %APPDATA%\opera software\opera stable\browser.js.xls
from %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\map0 to %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\map0.xls
from %APPDATA%\telegram desktop\tdata\usertag to %APPDATA%\telegram desktop\tdata\usertag.xls
from %APPDATA%\qipguard\cache to %APPDATA%\qipguard\cache.xls
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\webappsstore.sqlite.xls
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\foldertree.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\foldertree.json.xls
from %APPDATA%\winamp\winamp.m3u8 to %APPDATA%\winamp\winamp.m3u8.xls
from %APPDATA%\winamp\plugins\milkdrop2\milk2_img.ini to %APPDATA%\winamp\plugins\milkdrop2\milk2_img.ini.xls
from %APPDATA%\winamp\plugins\milkdrop2\milk2_msg.ini to %APPDATA%\winamp\plugins\milkdrop2\milk2_msg.ini.xls
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.xls
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\abook.mab to %APPDATA%\thunderbird\profiles\wjj9aet2.default\abook.mab.xls
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\blist.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\blist.sqlite.xls
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\compatibility.ini to %APPDATA%\thunderbird\profiles\wjj9aet2.default\compatibility.ini.xls
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite.xls
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\store.json.mozlz4.xls
from %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage to %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage.xls
from %APPDATA%\winamp\winamp.ini to %APPDATA%\winamp\winamp.ini.xls
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\global-messages-db.sqlite.xls
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\history.mab to %APPDATA%\thunderbird\profiles\wjj9aet2.default\history.mab.xls
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\permissions.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\permissions.sqlite.xls
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\places.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\places.sqlite.xls
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\prefs.js to %APPDATA%\thunderbird\profiles\wjj9aet2.default\prefs.js.xls
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\session.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\session.json.xls
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\sessioncheckpoints.json.xls
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\times.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\times.json.xls
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.json.xls
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.ini to %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.ini.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\102.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\102.ico.xls
from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\telegram.exe.xls
from %APPDATA%\opera software\opera stable\update_prefs.json to %APPDATA%\opera software\opera stable\update_prefs.json.xls
from %APPDATA%\opera software\opera stable\visited links to %APPDATA%\opera software\opera stable\visited links.xls
from %APPDATA%\opera software\opera stable\web data to %APPDATA%\opera software\opera stable\web data.xls
from %APPDATA%\opera software\opera stable\web data-journal to %APPDATA%\opera software\opera stable\web data-journal.xls
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000003.ldb to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000003.ldb.xls
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\current to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\current.xls
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log.xls
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log.old to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log.old.xls
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\manifest-000001 to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\manifest-000001.xls
from %APPDATA%\opera software\opera stable\transportsecurity to %APPDATA%\opera software\opera stable\transportsecurity.xls
from %APPDATA%\opera software\opera stable\cookies-journal to %APPDATA%\opera software\opera stable\cookies-journal.xls
from %APPDATA%\opera software\opera stable\thumbnails.db-journal to %APPDATA%\opera software\opera stable\thumbnails.db-journal.xls
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\quotamanager-journal to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\quotamanager-journal.xls
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_0 to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_0.xls
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_1 to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_1.xls
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_2 to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_2.xls
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_3 to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_3.xls
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\index to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\index.xls
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\databases.db-journal to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\databases.db-journal.xls
from %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage to %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage.xls
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\cookies-journal to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\cookies-journal.xls
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\cookies to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\cookies.xls
from %APPDATA%\opera software\opera stable\cookies to %APPDATA%\opera software\opera stable\cookies.xls
from %APPDATA%\opera software\opera stable\ssdfp2512.4.1739910927 to %APPDATA%\opera software\opera stable\ssdfp2512.4.1739910927.xls
from %APPDATA%\opera software\opera stable\origin bound certs-journal to %APPDATA%\opera software\opera stable\origin bound certs-journal.xls
from %APPDATA%\opera software\opera stable\favorites.db-journal to %APPDATA%\opera software\opera stable\favorites.db-journal.xls
from %APPDATA%\opera software\opera stable\history to %APPDATA%\opera software\opera stable\history.xls
from %APPDATA%\opera software\opera stable\history provider cache to %APPDATA%\opera software\opera stable\history provider cache.xls
from %APPDATA%\opera software\opera stable\history-journal to %APPDATA%\opera software\opera stable\history-journal.xls
from %APPDATA%\opera software\opera stable\local state to %APPDATA%\opera software\opera stable\local state.xls
from %APPDATA%\opera software\opera stable\login data to %APPDATA%\opera software\opera stable\login data.xls
from %APPDATA%\opera software\opera stable\login data-journal to %APPDATA%\opera software\opera stable\login data-journal.xls
from %APPDATA%\opera software\opera stable\opera_autoupdate.log to %APPDATA%\opera software\opera stable\opera_autoupdate.log.xls
from %APPDATA%\opera software\opera stable\ssdfp2544.3.670597881 to %APPDATA%\opera software\opera stable\ssdfp2544.3.670597881.xls
from %APPDATA%\opera software\opera stable\favicons to %APPDATA%\opera software\opera stable\favicons.xls
from %APPDATA%\opera software\opera stable\favicons-journal to %APPDATA%\opera software\opera stable\favicons-journal.xls
from %APPDATA%\opera software\opera stable\preferences to %APPDATA%\opera software\opera stable\preferences.xls
from %APPDATA%\opera software\opera stable\quotamanager to %APPDATA%\opera software\opera stable\quotamanager.xls
from %APPDATA%\opera software\opera stable\quotamanager-journal to %APPDATA%\opera software\opera stable\quotamanager-journal.xls
from %APPDATA%\opera software\opera stable\session.db-journal to %APPDATA%\opera software\opera stable\session.db-journal.xls
from %APPDATA%\opera software\opera stable\session.dbak to %APPDATA%\opera software\opera stable\session.dbak.xls
from %APPDATA%\opera software\opera stable\siteprefs.json to %APPDATA%\opera software\opera stable\siteprefs.json.xls
from %APPDATA%\opera software\opera stable\ssdfp1652.1.1724122967 to %APPDATA%\opera software\opera stable\ssdfp1652.1.1724122967.xls
from %APPDATA%\opera software\opera stable\ssdfp2216.0.2078311798 to %APPDATA%\opera software\opera stable\ssdfp2216.0.2078311798.xls
from %APPDATA%\opera software\opera stable\origin bound certs to %APPDATA%\opera software\opera stable\origin bound certs.xls
from %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt to %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt.xls
from %APPDATA%\mra\update\languages.dict to %APPDATA%\mra\update\languages.dict.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\102_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\102_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\pivo.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\pivo.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\pu_kofe.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\pu_kofe.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\rabotau.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\rabotau.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\rocket.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\rocket.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\seekfriends.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\seekfriends.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\seekfriends_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\seekfriends_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\splu.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\splu.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\splu_bit.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\splu_bit.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\na_vstreche.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\na_vstreche.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\na_rabote.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\na_rabote.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\pivo_bit.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\pivo_bit.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\star.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\star.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_33.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_33.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_34.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_34.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_35.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_35.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_36.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_36.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_37.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_37.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_38.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_38.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_40.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_40.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_29.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_29.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_30.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_30.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_32.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_32.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\98_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\98_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_41.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_41.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\99_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\99_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\chat.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\chat.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\chat_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\chat_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\cherep.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\cherep.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\dnd.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\dnd.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\dnd_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\dnd_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\doma.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\doma.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\em.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\em.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\music.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\music.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\belka.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\belka.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\kut.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\kut.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gde_ia.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gde_ia.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_inoplanet_razum.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_inoplanet_razum.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_krivetko.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_krivetko.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_poteralsa.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_poteralsa.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_soshl_asuma.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_soshl_asuma.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_utko.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_utko.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\igrau.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\igrau.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\kuru.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\kuru.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gizn_gavno.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gizn_gavno.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gotovlu.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gotovlu.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gulau.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gulau.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\boleu.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\boleu.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_42.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_42.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_49.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_49.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_institute.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_institute.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_institute_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_institute_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_shkole.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_shkole.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_shkole_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_shkole_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\wrong_data.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\wrong_data.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_connecting.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_connecting.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_gray.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_gray.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\telefon_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\telefon_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\telefon.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\telefon.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\vi_oshiblis_nomerom_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\vi_oshiblis_nomerom_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_offline.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_offline.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_chat.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_chat.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_dnd.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_dnd.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_gray.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_gray.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_invisible.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_invisible.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_offline.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_offline.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_online.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_online.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\seekfriends.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\seekfriends.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_online.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_online.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_wrong_data.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_wrong_data.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_away.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_away.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\vi_oshiblis_nomerom.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\vi_oshiblis_nomerom.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_43.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_43.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_44.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_44.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_50.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_50.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away_big.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away_big.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away_xp_big.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away_xp_big.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_connecting.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_connecting.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_connecting_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_connecting_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online_xp_big.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online_xp_big.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_45.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_45.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_mobile.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_mobile.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline_big.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline_big.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline_xp_big.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline_xp_big.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online_big.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online_big.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible_big.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible_big.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible_xp_big.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible_xp_big.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\99.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\99.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\98.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\98.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\103.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\103.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\64.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\64.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\64_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\64_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\65.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\65.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\65_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\65_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\66.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\66.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\66_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\66_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\67.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\67.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\67_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\67_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\63.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\63.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\73_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\73_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\62_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\62_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\69_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\69_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\70.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\70.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\70_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\70_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\71.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\71.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\71_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\71_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\72.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\72.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\72_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\72_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\73.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\73.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\68_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\68_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\68.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\68.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\69.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\69.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\61_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\61_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\57.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\57.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\104.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\104.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\104_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\104_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\11.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\11.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\11_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\11_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\12.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\12.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\12_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\12_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\13.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\13.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\13_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\13_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\62.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\62.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\74.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\74.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\103_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\103_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\57_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\57_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\58.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\58.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\58_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\58_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\59.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\59.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\59_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\59_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\60.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\60.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\60_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\60_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\61.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\61.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\56_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\56_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\56.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\56.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\63_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\63_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\74_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\74_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\88.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\88.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\89.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\89.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\89_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\89_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\90.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\90.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\90_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\90_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\91.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\91.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\91_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\91_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\92.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\92.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\87_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\87_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\86_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\86_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\88_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\88_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\92_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\92_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\94_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\94_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\95.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\95.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\95_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\95_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\96.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\96.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\96_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\96_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\97.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\97.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\97_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\97_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\93.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\93.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\93_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\93_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\94.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\94.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\87.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\87.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\86.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\86.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\75.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\75.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\76.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\76.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\76_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\76_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\77.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\77.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\77_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\77_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\78.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\78.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\78_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\78_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\79.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\79.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\79_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\79_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\80.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\80.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\75_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\75_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\80_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\80_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\81_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\81_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\82.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\82.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\82_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\82_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\83.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\83.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\83_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\83_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\84.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\84.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\84_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\84_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\85.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\85.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\85_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\85_xp.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\81.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\81.ico.xls
from %APPDATA%\mail.ru\agent\mra\smiles\flash\zadolbal.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\zadolbal.swf.xls
from %APPDATA%\mail.ru\agent\mra\html\uz\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\uz\loading\progress_agent.gif.xls

Modifies the following files

D:\install.log
%HOMEPATH%\favorites\microsoft websites\ie add-on site.url
%HOMEPATH%\favorites\msn websites\msnbc news.url
%HOMEPATH%\favorites\msn websites\msn.url
%HOMEPATH%\favorites\msn websites\msn sports.url
%HOMEPATH%\favorites\msn websites\msn money.url
%HOMEPATH%\favorites\msn websites\msn entertainment.url
%HOMEPATH%\favorites\msn websites\msn autos.url
%HOMEPATH%\favorites\windows live\windows live spaces.url
%HOMEPATH%\favorites\windows live\windows live mail.url
%HOMEPATH%\favorites\windows live\windows live gallery.url
%HOMEPATH%\favorites\windows live\get windows live.url
%HOMEPATH%\favorites\desktop.ini
%HOMEPATH%\links\recentplaces.lnk
%HOMEPATH%\links\downloads.lnk
%HOMEPATH%\links\desktop.lnk
%HOMEPATH%\links\desktop.ini
%HOMEPATH%\music\desktop.ini
%HOMEPATH%\pictures\desktop.ini
%HOMEPATH%\saved games\desktop.ini
%HOMEPATH%\searches\indexed locations.search-ms
%HOMEPATH%\searches\everywhere.search-ms
%HOMEPATH%\searches\desktop.ini
%HOMEPATH%\videos\desktop.ini
%HOMEPATH%\ntuser.pol
<Drive name for removable media>:\correct.avi
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini
C:\users\desktop.ini
%HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url
%HOMEPATH%\favorites\microsoft websites\microsoft at home.url

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'%TEMP%\c12bc342-0581-4229-9ee3-89b4fbfed447\advancedrun.exe' /EXEFilename "%TEMP%\c12bc342-0581-4229-9ee3-89b4fbfed447\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
'%TEMP%\c12bc342-0581-4229-9ee3-89b4fbfed447\advancedrun.exe' /SpecialRun 4101d8 2504
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%CommonProgramFiles%\System\偟倮偐倳倪倭偛倳倳倫倭倮偞偛倪\svchost.exe" -Force' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force' (with hidden window)
'%TEMP%\c12bc342-0581-4229-9ee3-89b4fbfed447\advancedrun.exe' /EXEFilename "%TEMP%\c12bc342-0581-4229-9ee3-89b4fbfed447\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run' (with hidden window)

Executes the following

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%CommonProgramFiles%\System\偟倮偐倳倪倭偛倳倳倫倭倮偞偛倪\svchost.exe" -Force
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial