Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.Encoder.35526

Added to the Dr.Web virus database: 2022-07-01

Virus description added:

Technical Information

Modifies file system
Creates the following files
  • %ALLUSERSPROFILE%\xi\lqxfet.sre
  • %APPDATA%\icqm\icq\translation\how_fix_files.htm
  • %APPDATA%\microsoft\dbgclr\7.1\how_fix_files.htm
  • %APPDATA%\microsoft\internet explorer\quick launch\how_fix_files.htm
  • %APPDATA%\icqm\icq\sounds\how_fix_files.htm
  • %LOCALAPPDATA%\adobe\color\profiles\how_fix_files.htm
  • %APPDATA%\icqm\icq\video\how_fix_files.htm
  • C:\far2\pluginsdk\headers.c\how_fix_files.htm
  • %APPDATA%\microsoft\msdn\7.0\how_fix_files.htm
  • %APPDATA%\microsoft\office\recent\how_fix_files.htm
  • %LOCALAPPDATA%\microsoft\internet explorer\how_fix_files.htm
  • C:\far2\plugins\compare\how_fix_files.htm
  • %LOCALAPPDATA%\microsoft\device metadata\how_fix_files.htm
  • %LOCALAPPDATA%\google\chrome\user data\how_fix_files.htm
  • %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\how_fix_files.htm
  • %LOCALAPPDATA%\microsoft\media player\how_fix_files.htm
  • %APPDATA%\adobe\acrobat\dc\security\how_fix_files.htm
  • %APPDATA%\opera software\opera stable\databases\how_fix_files.htm
  • %APPDATA%\opera software\opera stable\dictionaries\how_fix_files.htm
  • C:\far2\plugins\ftp\lib\how_fix_files.htm
  • %APPDATA%\adobe\acrobat\dc\preferences\how_fix_files.htm
  • %APPDATA%\opera software\opera stable\extension state\how_fix_files.htm
  • %APPDATA%\icqm\icq\smiles\flash\how_fix_files.htm
  • %APPDATA%\icqm\icq\fonts\how_fix_files.htm
  • %APPDATA%\icqm\icq\smiles\how_fix_files.htm
  • %APPDATA%\icqm\icq\dll\how_fix_files.htm
  • C:\far2\plugins\tmppanel\how_fix_files.htm
  • %APPDATA%\icqm\icq\database\how_fix_files.htm
  • %LOCALAPPDATA%low\oracle\java\au\how_fix_files.htm
  • %APPDATA%\microsoft\publisher building blocks\how_fix_files.htm
  • %APPDATA%\telegram desktop\tdata\how_fix_files.htm
  • %APPDATA%\microsoft\templates\how_fix_files.htm
  • C:\far2\plugins\align\how_fix_files.htm
  • %APPDATA%\mra\update\how_fix_files.htm
  • %LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\how_fix_files.htm
  • %APPDATA%\adobe\acrobat\dc\how_fix_files.htm
  • C:\far2\plugins\autowrap\how_fix_files.htm
  • %LOCALAPPDATA%low\sun\java\deployment\how_fix_files.htm
  • %APPDATA%\icqm\icq\graphics\phone\how_fix_files.htm
  • %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\how_fix_files.htm
  • C:\far2\plugins\brackets\how_fix_files.htm
  • C:\far2\plugins\emenu\how_fix_files.htm
  • C:\far2\plugins\macroview\how_fix_files.htm
  • C:\far2\plugins\arclite\how_fix_files.htm
  • C:\far2\plugins\hlfviewer\how_fix_files.htm
  • C:\far2\plugins\editcase\how_fix_files.htm
  • C:\far2\plugins\farcmds\how_fix_files.htm
  • C:\far2\plugins\network\how_fix_files.htm
  • C:\far2\plugins\drawline\how_fix_files.htm
  • C:\far2\plugins\filecase\how_fix_files.htm
  • C:\far2\plugins\proclist\how_fix_files.htm
  • %APPDATA%\mirc\scripts\how_fix_files.htm
  • C:\far2\plugins\ftp\how_fix_files.htm
  • %APPDATA%\mail.ru\agent\mra\dll\how_fix_files.htm
  • %APPDATA%\mail.ru\agent\mra\smiles\how_fix_files.htm
  • %APPDATA%\mail.ru\agent\mra\fonts\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\bg\loading\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\kz\jabber\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\kz\loading\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\pt\jabber\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\pt\loading\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\ru\error\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\ru\jabber\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\bg\error\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\cz\loading\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\ru\loading\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\tr\error\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\tr\loading\how_fix_files.htm
  • %LOCALAPPDATA%low\microsoft\internet explorer\services\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\ua\error\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\uz\error\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\uz\jabber\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\uz\loading\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\tr\jabber\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\en\jabber\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\en\error\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\en\loading\how_fix_files.htm
  • %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\kiks.yandex.ru\how_fix_files.htm
  • %APPDATA%\mail.ru\agent\mra\graphics\phone\how_fix_files.htm
  • %APPDATA%\icqm\icq\smiles\smiles\8march\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\kz\error\how_fix_files.htm
  • %LOCALAPPDATA%\microsoft\msdn\7.0\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\cz\jabber\how_fix_files.htm
  • %APPDATA%\opera software\opera stable\jump list iconsold\how_fix_files.htm
  • %APPDATA%\mail.ru\agent\mra\video\how_fix_files.htm
  • %APPDATA%\mail.ru\agent\mra\translation\how_fix_files.htm
  • %APPDATA%\thunderbird\profiles\wjj9aet2.default\how_fix_files.htm
  • %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\how_fix_files.htm
  • %APPDATA%\microsoft\document building blocks\1033\14\how_fix_files.htm
  • %APPDATA%\mail.ru\agent\mra\sounds\how_fix_files.htm
  • %APPDATA%\opera software\opera stable\jump list icons\how_fix_files.htm
  • %APPDATA%\winamp\plugins\milkdrop2\how_fix_files.htm
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\how_fix_files.htm
  • %LOCALAPPDATA%\microsoft\dbgclr\7.1\how_fix_files.htm
  • %APPDATA%\icqm\icq\smiles\smiles\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\ua\loading\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\de\jabber\how_fix_files.htm
  • %APPDATA%\opera software\opera stable\local storage\how_fix_files.htm
  • %LOCALAPPDATA%\microsoft\feeds\feeds for united states~\how_fix_files.htm
  • %LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\how_fix_files.htm
  • %LOCALAPPDATA%\microsoft\office\onetconfig\how_fix_files.htm
  • C:\far2\pluginsdk\headers.pas\how_fix_files.htm
  • %APPDATA%\mail.ru\agent\mra\database\how_fix_files.htm
  • %LOCALAPPDATA%\microsoft\internet explorer\domstore\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\bg\jabber\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\cz\error\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\de\error\how_fix_files.htm
  • %LOCALAPPDATA%\google\chrome\user data\default\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\de\loading\how_fix_files.htm
  • %APPDATA%\icqm\icq\html\pt\error\how_fix_files.htm
  • %APPDATA%\opera software\opera stable\how_fix_files.htm
  • C:\far2\fexcept\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1049\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1050\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1040\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\2052\how_fix_files.htm
  • C:\far2\addons\colors\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\dbgclr\7.1\1033\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1033\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1031\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1041\how_fix_files.htm
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\how_fix_files.htm
  • C:\users\public\desktop\how_fix_files.htm
  • %HOMEPATH%\desktop\how_fix_files.htm
  • %HOMEPATH%\downloads\how_fix_files.htm
  • %HOMEPATH%\favorites\how_fix_files.htm
  • %HOMEPATH%\music\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1036\how_fix_files.htm
  • C:\far2\documentation\eng\how_fix_files.htm
  • %HOMEPATH%\links\how_fix_files.htm
  • %ALLUSERSPROFILE%\xi\lqxfet.sre.rnsmcat4er
  • C:\far2\encyclopedia\how_fix_files.htm
  • C:\users\public\recorded tv\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\rac\statedata\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1046\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\rac\publisheddata\how_fix_files.htm
  • %ALLUSERSPROFILE%\adobe\arm\s\how_fix_files.htm
  • C:\far2\addons\how_fix_files.htm
  • %ALLUSERSPROFILE%\xi\gfuo.atl
  • %TEMP%\xuopdg.nlu
  • %HOMEPATH%\documents\how_fix_files.htm
  • C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft toolkit\how_fix_files.htm
  • %ALLUSERSPROFILE%\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft help\how_fix_files.htm
  • C:\users\default\how_fix_files.htm
  • C:\far2\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\office\how_fix_files.htm
  • C:\users\public\videos\how_fix_files.htm
  • %HOMEPATH%\contacts\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\how_fix_files.htm
  • C:\users\how_fix_files.htm
  • C:\totalcmd\how_fix_files.htm
  • %ALLUSERSPROFILE%\mozilla\logs\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\crypto\keys\how_fix_files.htm
  • %ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\how_fix_files.htm
  • %ALLUSERSPROFILE%\xi\gfuo.atl.rnsmcat4er
  • C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\how_fix_files.htm
  • %HOMEPATH%\how_fix_files.htm
  • %ALLUSERSPROFILE%\xi\how_fix_files.htm
  • C:\users\public\how_fix_files.htm
  • %TEMP%\ddaad.aux
  • %ALLUSERSPROFILE%\microsoft\user account pictures\how_fix_files.htm
  • %HOMEPATH%\pictures\how_fix_files.htm
  • %HOMEPATH%\saved games\how_fix_files.htm
  • %HOMEPATH%\searches\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\how_fix_files.htm
  • %APPDATA%\icq-profile\how_fix_files.htm
  • C:\far2\documentation\rus\how_fix_files.htm
  • C:\users\public\libraries\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\how_fix_files.htm
  • C:\users\public\pictures\sample pictures\how_fix_files.htm
  • %APPDATA%\mirc\how_fix_files.htm
  • %APPDATA%\mra\how_fix_files.htm
  • %APPDATA%\qipguard\how_fix_files.htm
  • %APPDATA%\thunderbird\how_fix_files.htm
  • %APPDATA%\telegram desktop\how_fix_files.htm
  • C:\users\public\music\sample music\how_fix_files.htm
  • %LOCALAPPDATA%\adobe\acrobat\dc\how_fix_files.htm
  • %APPDATA%\microsoft\mmc\how_fix_files.htm
  • %LOCALAPPDATA%\adobe\color\how_fix_files.htm
  • %APPDATA%\icq-profile\base\how_fix_files.htm
  • %APPDATA%\winamp\how_fix_files.htm
  • %APPDATA%\adobe\logtransport2\how_fix_files.htm
  • %APPDATA%\mozilla\firefox\how_fix_files.htm
  • C:\totalcmd\language\how_fix_files.htm
  • %APPDATA%\microsoft\office\how_fix_files.htm
  • %APPDATA%\mra\base\how_fix_files.htm
  • %APPDATA%\icq-profile\update\how_fix_files.htm
  • %LOCALAPPDATA%low\adobe\acrobat\dc\how_fix_files.htm
  • C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\how_fix_files.htm
  • %HOMEPATH%\favorites\microsoft websites\how_fix_files.htm
  • C:\far2\addons\xlat\russian\how_fix_files.htm
  • %HOMEPATH%\favorites\links for united states\how_fix_files.htm
  • %HOMEPATH%\videos\how_fix_files.htm
  • C:\users\public\pictures\how_fix_files.htm
  • C:\far2\addons\macros\how_fix_files.htm
  • C:\far2\addons\setup\how_fix_files.htm
  • C:\far2\addons\shell\how_fix_files.htm
  • C:\far2\addons\xlat\how_fix_files.htm
  • C:\far2\addons\colors\custom_highlighting\how_fix_files.htm
  • C:\far2\addons\colors\default_highlighting\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1042\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1028\how_fix_files.htm
  • %ALLUSERSPROFILE%\sun\java\java update\how_fix_files.htm
  • %APPDATA%\microsoft\protect\how_fix_files.htm
  • %LOCALAPPDATA%\applicationhistory\how_fix_files.htm
  • %HOMEPATH%\favorites\msn websites\how_fix_files.htm
  • C:\far2\encyclopedia\tap\how_fix_files.htm
  • C:\users\public\recorded tv\sample media\how_fix_files.htm
  • %HOMEPATH%\favorites\links\how_fix_files.htm
  • C:\users\public\videos\sample videos\how_fix_files.htm
  • C:\users\public\music\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\3082\how_fix_files.htm
  • C:\users\public\downloads\how_fix_files.htm
  • C:\users\public\documents\how_fix_files.htm
  • %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\how_fix_files.htm
  • %LOCALAPPDATA%\how_fix_files.htm
  • %APPDATA%\ghisler\how_fix_files.htm
  • %APPDATA%\icqm\icq\smiles\smiles\animated\how_fix_files.htm
Moves the following files
  • from %ALLUSERSPROFILE%\xi\gfuo.atl to %ALLUSERSPROFILE%\xi\gfuo.atl.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\coolguy.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\coolguy.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s017.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s017.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\dont_be_late.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\dont_be_late.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_away.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_away.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_busy.ico to %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_busy.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\101_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\101_xp.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_chat.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_chat.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\in_love.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\in_love.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_connecting.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_connecting.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_dnd.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_dnd.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\jealousy.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\jealousy.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\102.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\102.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_gray.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_gray.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s018.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s018.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\102_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\102_xp.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_invisible.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_invisible.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_gray.ico to %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_gray.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_offline.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_offline.ico.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_love.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_love.swf.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\crashes\store.json.mozlz4.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\14a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\14a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\kot_wow.swf to %APPDATA%\icqm\icq\smiles\flash\kot_wow.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\shout.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\shout.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\i_am_so_happy.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\i_am_so_happy.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s012.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s012.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf to %APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_away.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_away.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_busy.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_busy.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s013.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s013.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_gray.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_gray.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_offline.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_offline.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s014.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s014.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\smile.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_away.ico to %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_away.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s015.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s015.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_online.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_online.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\13a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\13a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\unknw.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\unknw.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\broken_heart.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\broken_heart.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_koster.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_koster.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s016.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s016.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\101.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\101.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_online.ico to %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_online.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\100_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\100_xp.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\104_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\104_xp.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\disappointed.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\disappointed.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\fist.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\fist.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\15a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\15a.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_snegyrka.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_snegyrka.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\likeu.swf to %APPDATA%\icqm\icq\smiles\flash\likeu.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\13.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\13.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\kissed.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\kissed.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\fuck.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\fuck.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s020.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s020.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\lets_play.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\lets_play.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\icq\seekfriends.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\seekfriends.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\icq\seekfriends_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\seekfriends_xp.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\lol.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\lol.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\heart.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\heart.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\on_wings.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\on_wings.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\hm.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\hm.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\icq\status_mobile.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\status_mobile.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\103_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\103_xp.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\12_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\12_xp.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\104.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\104.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\12.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\12.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\103.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\103.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_online.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_online.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\wacko2.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\wacko2.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_wrong_data.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_wrong_data.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\crocodile.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\crocodile.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_offline.ico to %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_offline.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\cry.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\cry.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\detzl.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\detzl.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_online.ico to %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_online.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\11.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\11.ico.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\bookmarkbackups\bookmarks-2022-04-14_14_x5qkry9yysawyostzmcdfa==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\bookmarkbackups\bookmarks-2022-04-14_14_x5qkry9yysawyostzmcdfa==.jsonlz4.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\11_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\11_xp.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\devil.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\devil.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\wink.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\wink.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\krizis.swf to %APPDATA%\icqm\icq\smiles\flash\krizis.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\die.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\die.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\kiss.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\yahoo.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\yahoo.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\laugh.swf to %APPDATA%\icqm\icq\smiles\flash\laugh.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s019.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s019.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss3.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss3.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s011.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s011.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_opyatnica.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_opyatnica.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\gamer.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\gamer.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\fool.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\fool.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\crazy.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\crazy.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\boo.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\boo.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s014.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s014.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\give_rose.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\give_rose.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\rainbow.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\rainbow.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\good.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\good.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s016.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s016.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\kiss_mini.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\kiss_mini.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s015.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s015.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s017.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s017.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\red.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\red.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\man_in_love.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\man_in_love.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sad.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s018.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s018.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s016.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s016.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s008.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\mocking.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\mocking.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\music.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\music.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\cool.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\cool.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\shok.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\shok.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s013.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s013.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\poison.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\poison.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\hungry.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\hungry.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\smiles\s008.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\s008.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s012.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s012.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\dance.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\dance.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\kiss.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s013.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s013.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s014.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s014.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\diablo.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\diablo.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\love.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\love.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\pistolet.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\pistolet.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s015.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s015.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\dirol.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\dirol.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\bye2.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\bye2.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\12a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\12a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s009.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s009.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\drinks.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\drinks.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s010.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s010.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\facepalm.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\facepalm.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s011.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s011.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s012.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s012.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_offline.ico to %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_offline.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\100.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\100.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\cry.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\cry.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_heart.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_heart.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_rose.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_rose.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\chillout.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\chillout.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\good.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\good.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\hang1.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\hang1.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\devochka.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\devochka.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\hi.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\hi.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\biganger.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\biganger.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\ireful.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\ireful.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\biggrin.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\biggrin.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\blink.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\blink.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\kot_obida.swf to %APPDATA%\icqm\icq\smiles\flash\kot_obida.swf.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_bolnoy.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_bolnoy.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s010.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s010.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\bullshit.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\bullshit.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\scratch_one-s_head.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\scratch_one-s_head.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s011.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s011.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_gray.ico to %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_gray.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\nea.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\nea.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\girl_angel.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\girl_angel.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s020.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s020.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\sad.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s019.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s019.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\sing.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sing.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\pardon.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\pardon.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\skuka.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\skuka.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\rofl.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\rofl.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\sleep.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sleep.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\rolleyes.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\rolleyes.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\dance.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\dance.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\smile.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\icq\24bit.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\24bit.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\tongue.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\tongue.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\victory.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\victory.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\diablo.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\diablo.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\wonder.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\wonder.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s009.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s009.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_away.ico to %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_away.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\bee.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\bee.gif.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles\wjj9aet2.default\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\webappsstore.sqlite.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\drinks.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\drinks.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_busy.ico to %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_busy.ico.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\canthearu.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\canthearu.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\history.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\history.gif.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\state.json.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\16a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\16a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thank you.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thank you.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\html\ru\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\ru\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\tears.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\tears.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf to %APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_away.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_away.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\think.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\think.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_chat.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_chat.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\vampire.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\vampire.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thumbs up.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thumbs up.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\66.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\66.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_dnd.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_dnd.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\victory.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\victory.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\zloradstvo.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\zloradstvo.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\66_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\66_xp.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\tongue out.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\tongue out.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\67.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\67.ico.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\html\pt\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\pt\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\html\tr\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\tr\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_gray.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_gray.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\32a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\32a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_offline.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_offline.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\31a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\31a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\surprised.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\surprised.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\unknown.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\unknown.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\html\kz\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\kz\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\wacko1.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\wacko1.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\sceptic.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\sceptic.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\sobaka.swf to %APPDATA%\icqm\icq\smiles\flash\sobaka.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\shy.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\shy.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\sad.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\30a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\30a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_wrong_data.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_wrong_data.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\wink.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\wink.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\scream.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\scream.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\65.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\65.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\smile.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\sleepy.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\sleepy.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\kisses.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kisses.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\yahoo.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\yahoo.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\stop.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\stop.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\yes.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\yes.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\65_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\65_xp.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\smile.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_online.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_online.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\67_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\67_xp.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_offline.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_offline.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf to %APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\71.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\71.ico.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_attack.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_attack.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\angel.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\angel.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\appl.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\appl.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\beauty.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\beauty.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\beer.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\beer.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\blew.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\blew.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\book.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\book.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\car.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\car.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\36a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\36a.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_hand.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_hand.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\krizis.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\krizis.swf.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_lick.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_lick.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\cry.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\cry.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\dance.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\dance.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\air_kiss.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\air_kiss.gif.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\webapps.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\webapps.json.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_wow.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_wow.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_invisible.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_invisible.ico.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\html\ua\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\ua\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\70_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\70_xp.ico.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\store.json.mozlz4.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\html\uz\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\uz\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\68.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\68.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\33a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\33a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\34a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\34a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\sorry.swf to %APPDATA%\icqm\icq\smiles\flash\sorry.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\68_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\68_xp.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\69.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\69.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\69_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\69_xp.ico.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_goodbye.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_goodbye.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_online.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_online.ico.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_nedutza.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_nedutza.swf.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\previous.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\previous.js.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\70.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\70.ico.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\recovery.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\recovery.js.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_obida.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_obida.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\tank.swf to %APPDATA%\icqm\icq\smiles\flash\tank.swf.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\upgrade.js-20150415140819 to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\upgrade.js-20150415140819.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_cool.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_cool.swf.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_spasibo.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_spasibo.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\56.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\56.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\13_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\13_xp.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\sorry.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\sorry.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\nea.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\nea.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\pardon.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\pardon.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\kukes.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\kukes.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\rofl.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\rofl.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\59_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\59_xp.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\falling asleep.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\falling asleep.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\19a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\19a.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\gangsta.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\gangsta.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\sad.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\gross.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\gross.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\20a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\20a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\21a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\21a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\laughter.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\laughter.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\in love.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\in love.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\22a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\22a.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\html\bg\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\bg\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kiss.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\59.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\59.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\want_you.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\want_you.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_right.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_right.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\drinking.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\drinking.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\guby.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\guby.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\64_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\64_xp.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\kiss.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\undress.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\undress.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\56_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\56_xp.ico.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_zombie.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_zombie.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\mad dog.swf to %APPDATA%\icqm\icq\smiles\flash\mad dog.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\57.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\57.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\57_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\57_xp.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\missyou.swf to %APPDATA%\icqm\icq\smiles\flash\missyou.swf.rnsmcat4er
  • from %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol to %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\58.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\58.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\58_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\58_xp.ico.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\duh.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\duh.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\mad.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\mad.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\man_in_love.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\man_in_love.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\mocking.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\mocking.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\17a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\17a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_left.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_left.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\music.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\music.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\29a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\29a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\23a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\23a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\60_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\60_xp.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\plug.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\plug.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\serdze.swf to %APPDATA%\icqm\icq\smiles\flash\serdze.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\shout.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\shout.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\26a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\26a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\really.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\really.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\64.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\64.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\skratch.swf to %APPDATA%\icqm\icq\smiles\flash\skratch.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\mad.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\mad.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\smeh.swf to %APPDATA%\icqm\icq\smiles\flash\smeh.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\27a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\27a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\nothing to say.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\nothing to say.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\rrr.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\rrr.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\smile.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_connecting.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_connecting.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\28a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\28a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_gray.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_gray.ico.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\html\en\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\en\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\63_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\63_xp.ico.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\joy.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\joy.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\listening to music.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\listening to music.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\rosy.swf to %APPDATA%\icqm\icq\smiles\flash\rosy.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\60.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\60.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\scratch_one-s_head.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\scratch_one-s_head.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\information.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\information.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\61.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\61.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\24a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\24a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissing.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissing.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\61_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\61_xp.ico.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\html\cz\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\cz\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\62.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\62.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\live.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\live.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\shok.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\shok.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\62_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\62_xp.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing out loud (lol).gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing out loud (lol).gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\ok.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\ok.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\oo.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\oo.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\html\de\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\de\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\pig.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\pig.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\25a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\25a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\rabotaet.swf to %APPDATA%\icqm\icq\smiles\flash\rabotaet.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissed.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissed.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\63.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\63.ico.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\gift.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gift.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\crazy.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\crazy.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s010.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s010.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\akitaka.swf to %APPDATA%\icqm\icq\smiles\flash\akitaka.swf.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\extension state\log to %APPDATA%\opera software\opera stable\extension state\log.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt to %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\origin bound certs to %APPDATA%\opera software\opera stable\origin bound certs.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\origin bound certs-journal to %APPDATA%\opera software\opera stable\origin bound certs-journal.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\preferences to %APPDATA%\opera software\opera stable\preferences.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\quotamanager to %APPDATA%\opera software\opera stable\quotamanager.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\extension state\log.old to %APPDATA%\opera software\opera stable\extension state\log.old.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\angel.swf to %APPDATA%\icqm\icq\smiles\flash\angel.swf.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\fonts\segoesc.ttf to %APPDATA%\mail.ru\agent\mra\fonts\segoesc.ttf.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\dll\altergeo.msi to %APPDATA%\mail.ru\agent\mra\dll\altergeo.msi.rnsmcat4er
  • from %APPDATA%\microsoft\internet explorer\quick launch\mail.ru agent.lnk to %APPDATA%\microsoft\internet explorer\quick launch\mail.ru agent.lnk.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\extension state\manifest-000001 to %APPDATA%\opera software\opera stable\extension state\manifest-000001.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\sounds\auth.wav to %APPDATA%\mail.ru\agent\mra\sounds\auth.wav.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\video\video.swf to %APPDATA%\mail.ru\agent\mra\video\video.swf.rnsmcat4er
  • from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\83aa4cc77f591dfc2374580bbd95f6ba_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\83aa4cc77f591dfc2374580bbd95f6ba_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.rnsmcat4er
  • from %APPDATA%\microsoft\document building blocks\1033\14\built-in building blocks.dotx to %APPDATA%\microsoft\document building blocks\1033\14\built-in building blocks.dotx.rnsmcat4er
  • from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f58155b4b1d5a524ca0261c3ee99fb50_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f58155b4b1d5a524ca0261c3ee99fb50_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\extension state\current to %APPDATA%\opera software\opera stable\extension state\current.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\sounds\busy.wav to %APPDATA%\mail.ru\agent\mra\sounds\busy.wav.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\opera_autoupdate.log to %APPDATA%\opera software\opera stable\opera_autoupdate.log.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\extension state\000006.ldb to %APPDATA%\opera software\opera stable\extension state\000006.ldb.rnsmcat4er
  • from %APPDATA%\icqm\icq\sounds\ring.mp3 to %APPDATA%\icqm\icq\sounds\ring.mp3.rnsmcat4er
  • from %APPDATA%\icqm\icq\sounds\start.wav to %APPDATA%\icqm\icq\sounds\start.wav.rnsmcat4er
  • from %APPDATA%\icqm\icq\sounds\test_sound.wav to %APPDATA%\icqm\icq\sounds\test_sound.wav.rnsmcat4er
  • from %APPDATA%\icqm\icq\sounds\voiceend.wav to %APPDATA%\icqm\icq\sounds\voiceend.wav.rnsmcat4er
  • from %APPDATA%\microsoft\office\recent\xml_excel.lnk to %APPDATA%\microsoft\office\recent\xml_excel.lnk.rnsmcat4er
  • from %APPDATA%\microsoft\office\recent\xml_excel_wiki.lnk to %APPDATA%\microsoft\office\recent\xml_excel_wiki.lnk.rnsmcat4er
  • from %APPDATA%\microsoft\office\recent\_copy_license_ja.lnk to %APPDATA%\microsoft\office\recent\_copy_license_ja.lnk.rnsmcat4er
  • from %APPDATA%\adobe\acrobat\dc\security\addressbook.acrodata to %APPDATA%\adobe\acrobat\dc\security\addressbook.acrodata.rnsmcat4er
  • from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\2365fd05-48cb-42f9-a388-5fd82ffd2512 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\2365fd05-48cb-42f9-a388-5fd82ffd2512.rnsmcat4er
  • from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\24a81978-4594-42c5-80e9-bcd9abebab41 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\24a81978-4594-42c5-80e9-bcd9abebab41.rnsmcat4er
  • from %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\map0 to %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\map0.rnsmcat4er
  • from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\5fea2324-401c-4a67-adf5-81a4571f8b7d to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\5fea2324-401c-4a67-adf5-81a4571f8b7d.rnsmcat4er
  • from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\857f1812-3b8b-41fd-99c5-09d06e6d1983 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\857f1812-3b8b-41fd-99c5-09d06e6d1983.rnsmcat4er
  • from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\9a5de8c5-f1f1-4a14-bd2a-9a24fc199001 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\9a5de8c5-f1f1-4a14-bd2a-9a24fc199001.rnsmcat4er
  • from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\ae597e89-6b58-4713-b543-846c970a2b49 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\ae597e89-6b58-4713-b543-846c970a2b49.rnsmcat4er
  • from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\b9ed44f4-c00d-45f3-9d18-c556a9a58c43 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\b9ed44f4-c00d-45f3-9d18-c556a9a58c43.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\extension state\000003.ldb to %APPDATA%\opera software\opera stable\extension state\000003.ldb.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\login data-journal to %APPDATA%\opera software\opera stable\login data-journal.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\databases\databases.db-journal to %APPDATA%\opera software\opera stable\databases\databases.db-journal.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\extension state\000007.log to %APPDATA%\opera software\opera stable\extension state\000007.log.rnsmcat4er
  • from %APPDATA%\icqm\icq\sounds\otprav.wav to %APPDATA%\icqm\icq\sounds\otprav.wav.rnsmcat4er
  • from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\d8ae0dbf-027a-4aa0-b5b7-f670a7266fd2 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\d8ae0dbf-027a-4aa0-b5b7-f670a7266fd2.rnsmcat4er
  • from %APPDATA%\icqm\icq\sounds\otprav.mp3 to %APPDATA%\icqm\icq\sounds\otprav.mp3.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\s008.gif.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\jump list iconsold\3651.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3651.tmp.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\jump list iconsold\36a1.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\36a1.tmp.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\jump list iconsold\36c3.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\36c3.tmp.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\jump list iconsold\3703.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3703.tmp.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\jump list iconsold\3724.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3724.tmp.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\jump list iconsold\3765.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3765.tmp.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage to %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\jump list iconsold\3796.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3796.tmp.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage-journal.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage to %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\quotamanager-journal to %APPDATA%\opera software\opera stable\quotamanager-journal.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\compatibility.ini.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\database\citylist_en.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_en.csv.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage-journal.rnsmcat4er
  • from %APPDATA%\microsoft\internet explorer\quick launch\mozilla thunderbird.lnk to %APPDATA%\microsoft\internet explorer\quick launch\mozilla thunderbird.lnk.rnsmcat4er
  • from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\d524265f-dddf-4bb6-9b50-623f924971ba to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\d524265f-dddf-4bb6-9b50-623f924971ba.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\database\citylist_kz.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_kz.csv.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage to %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\jump list icons\529f.tmp to %APPDATA%\opera software\opera stable\jump list icons\529f.tmp.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\sounds\call_waiting.wav to %APPDATA%\mail.ru\agent\mra\sounds\call_waiting.wav.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\sounds\call_in.wav to %APPDATA%\mail.ru\agent\mra\sounds\call_in.wav.rnsmcat4er
  • from %APPDATA%\winamp\plugins\milkdrop2\milk2_msg.ini to %APPDATA%\winamp\plugins\milkdrop2\milk2_msg.ini.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\jump list icons\50ed.tmp to %APPDATA%\opera software\opera stable\jump list icons\50ed.tmp.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\jump list icons\514d.tmp to %APPDATA%\opera software\opera stable\jump list icons\514d.tmp.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\jump list icons\516e.tmp to %APPDATA%\opera software\opera stable\jump list icons\516e.tmp.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\sounds\conference.wav to %APPDATA%\mail.ru\agent\mra\sounds\conference.wav.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\jump list icons\51ce.tmp to %APPDATA%\opera software\opera stable\jump list icons\51ce.tmp.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\sounds\error.wav to %APPDATA%\mail.ru\agent\mra\sounds\error.wav.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\jump list icons\51ff.tmp to %APPDATA%\opera software\opera stable\jump list icons\51ff.tmp.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\jump list icons\524f.tmp to %APPDATA%\opera software\opera stable\jump list icons\524f.tmp.rnsmcat4er
  • from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\bd5b067d-34b5-40ef-9a93-eff9fd1771a3 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\bd5b067d-34b5-40ef-9a93-eff9fd1771a3.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\sounds\letter.wav to %APPDATA%\mail.ru\agent\mra\sounds\letter.wav.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\sounds\message.wav to %APPDATA%\mail.ru\agent\mra\sounds\message.wav.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\sounds\no_answer.wav to %APPDATA%\mail.ru\agent\mra\sounds\no_answer.wav.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\sounds\otprav.wav to %APPDATA%\mail.ru\agent\mra\sounds\otprav.wav.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\sounds\ring.wav to %APPDATA%\mail.ru\agent\mra\sounds\ring.wav.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\sounds\start.wav to %APPDATA%\mail.ru\agent\mra\sounds\start.wav.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\sounds\test_sound.wav to %APPDATA%\mail.ru\agent\mra\sounds\test_sound.wav.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\sounds\voiceend.wav to %APPDATA%\mail.ru\agent\mra\sounds\voiceend.wav.rnsmcat4er
  • from %APPDATA%\winamp\plugins\milkdrop2\milk2_img.ini to %APPDATA%\winamp\plugins\milkdrop2\milk2_img.ini.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\skin.txt to %APPDATA%\mail.ru\agent\mra\smiles\skin.txt.rnsmcat4er
  • from %APPDATA%\winamp\plugins\ml\ml_online.ini to %APPDATA%\winamp\plugins\ml\ml_online.ini.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles\wjj9aet2.default\blist.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\blist.sqlite.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\addons.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\addons.json.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\skin.txt to %APPDATA%\icqm\icq\smiles\skin.txt.rnsmcat4er
  • from %APPDATA%\microsoft\internet explorer\quick launch\icq.lnk to %APPDATA%\microsoft\internet explorer\quick launch\icq.lnk.rnsmcat4er
  • from %APPDATA%\icq-profile\update\languages.dict to %APPDATA%\icq-profile\update\languages.dict.rnsmcat4er
  • from %APPDATA%\telegram desktop\tdata\90ef50e22e92cb8c0 to %APPDATA%\telegram desktop\tdata\90ef50e22e92cb8c0.rnsmcat4er
  • from %APPDATA%\icq-profile\update\languages.hash to %APPDATA%\icq-profile\update\languages.hash.rnsmcat4er
  • from %APPDATA%\microsoft\uproof\excludedictionaryen0409.lex to %APPDATA%\microsoft\uproof\excludedictionaryen0409.lex.rnsmcat4er
  • from %APPDATA%\microsoft\uproof\excludedictionaryen0809.lex to %APPDATA%\microsoft\uproof\excludedictionaryen0809.lex.rnsmcat4er
  • from %APPDATA%\icq-profile\update\ver.txt to %APPDATA%\icq-profile\update\ver.txt.rnsmcat4er
  • from %APPDATA%\mirc\scripts\aliases.ini to %APPDATA%\mirc\scripts\aliases.ini.rnsmcat4er
  • from %APPDATA%\microsoft\templates\normal.dotm to %APPDATA%\microsoft\templates\normal.dotm.rnsmcat4er
  • from %APPDATA%\mra\update\languages.aff to %APPDATA%\mra\update\languages.aff.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\bookmarks.bak to %APPDATA%\opera software\opera stable\bookmarks.bak.rnsmcat4er
  • from %APPDATA%\mirc\scripts\popups.ini to %APPDATA%\mirc\scripts\popups.ini.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\bookmarksextras to %APPDATA%\opera software\opera stable\bookmarksextras.rnsmcat4er
  • from %APPDATA%\adobe\acrobat\dc\tmdocs.sav to %APPDATA%\adobe\acrobat\dc\tmdocs.sav.rnsmcat4er
  • from %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c1 to %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c1.rnsmcat4er
  • from %APPDATA%\telegram desktop\tdata\prefix to %APPDATA%\telegram desktop\tdata\prefix.rnsmcat4er
  • from %APPDATA%\telegram desktop\tdata\settings0 to %APPDATA%\telegram desktop\tdata\settings0.rnsmcat4er
  • from %APPDATA%\mra\update\languages.dict to %APPDATA%\mra\update\languages.dict.rnsmcat4er
  • from %APPDATA%\adobe\acrobat\dc\tmgrpprm.sav to %APPDATA%\adobe\acrobat\dc\tmgrpprm.sav.rnsmcat4er
  • from %APPDATA%\thunderbird\crash reports\installtime20150330093429 to %APPDATA%\thunderbird\crash reports\installtime20150330093429.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\browser.js to %APPDATA%\opera software\opera stable\browser.js.rnsmcat4er
  • from %APPDATA%\mra\base\opt.dbs to %APPDATA%\mra\base\opt.dbs.rnsmcat4er
  • from %APPDATA%\mra\base\mra.dbs to %APPDATA%\mra\base\mra.dbs.rnsmcat4er
  • from %ALLUSERSPROFILE%\xi\lqxfet.sre to %ALLUSERSPROFILE%\xi\lqxfet.sre.rnsmcat4er
  • from %APPDATA%\ghisler\wincmd.ini to %APPDATA%\ghisler\wincmd.ini.rnsmcat4er
  • from %APPDATA%\mirc\mirc.ini to %APPDATA%\mirc\mirc.ini.rnsmcat4er
  • from %APPDATA%\mirc\servers.ini to %APPDATA%\mirc\servers.ini.rnsmcat4er
  • from %APPDATA%\mirc\urls.ini to %APPDATA%\mirc\urls.ini.rnsmcat4er
  • from %APPDATA%\qipguard\cache to %APPDATA%\qipguard\cache.rnsmcat4er
  • from %APPDATA%\telegram desktop\log.txt to %APPDATA%\telegram desktop\log.txt.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.rnsmcat4er
  • from %APPDATA%\winamp\demo.mp3 to %APPDATA%\winamp\demo.mp3.rnsmcat4er
  • from %APPDATA%\adobe\logtransport2\logtransport2.cfg to %APPDATA%\adobe\logtransport2\logtransport2.cfg.rnsmcat4er
  • from %APPDATA%\icq-profile\base\mra.dbs to %APPDATA%\icq-profile\base\mra.dbs.rnsmcat4er
  • from %APPDATA%\microsoft\mmc\taskschd to %APPDATA%\microsoft\mmc\taskschd.rnsmcat4er
  • from %APPDATA%\icq-profile\base\opt.dbs to %APPDATA%\icq-profile\base\opt.dbs.rnsmcat4er
  • from %APPDATA%\winamp\winamp.ini to %APPDATA%\winamp\winamp.ini.rnsmcat4er
  • from %APPDATA%\winamp\winamp.m3u8 to %APPDATA%\winamp\winamp.m3u8.rnsmcat4er
  • from %APPDATA%\microsoft\uproof\custom.dic to %APPDATA%\microsoft\uproof\custom.dic.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.rnsmcat4er
  • from %APPDATA%\microsoft\office\mso1033.acl to %APPDATA%\microsoft\office\mso1033.acl.rnsmcat4er
  • from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist.rnsmcat4er
  • from %APPDATA%\icq-profile\update\languages.aff to %APPDATA%\icq-profile\update\languages.aff.rnsmcat4er
  • from %APPDATA%\icqm\icq\sounds\no_answer.wav to %APPDATA%\icqm\icq\sounds\no_answer.wav.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\database\citylist_ru.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_ru.csv.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\bookmarks to %APPDATA%\opera software\opera stable\bookmarks.rnsmcat4er
  • from %APPDATA%\icqm\icq\database\citylist_uz.csv to %APPDATA%\icqm\icq\database\citylist_uz.csv.rnsmcat4er
  • from %APPDATA%\icqm\icq\sounds\busy.mp3 to %APPDATA%\icqm\icq\sounds\busy.mp3.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\local state to %APPDATA%\opera software\opera stable\local state.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\login data to %APPDATA%\opera software\opera stable\login data.rnsmcat4er
  • from %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk to %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk.rnsmcat4er
  • from %APPDATA%\icqm\icq\sounds\call_in.wav to %APPDATA%\icqm\icq\sounds\call_in.wav.rnsmcat4er
  • from %APPDATA%\icqm\icq\sounds\conference.mp3 to %APPDATA%\icqm\icq\sounds\conference.mp3.rnsmcat4er
  • from %APPDATA%\icqm\icq\sounds\error.wav to %APPDATA%\icqm\icq\sounds\error.wav.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\crash reports\installtime20150415140819 to %APPDATA%\mozilla\firefox\crash reports\installtime20150415140819.rnsmcat4er
  • from %APPDATA%\microsoft\office\recent\clarify.lnk to %APPDATA%\microsoft\office\recent\clarify.lnk.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles\wjj9aet2.default\abook.mab to %APPDATA%\thunderbird\profiles\wjj9aet2.default\abook.mab.rnsmcat4er
  • from %APPDATA%\microsoft\office\recent\license_en.lnk to %APPDATA%\microsoft\office\recent\license_en.lnk.rnsmcat4er
  • from %APPDATA%\icqm\icq\sounds\letter.wav to %APPDATA%\icqm\icq\sounds\letter.wav.rnsmcat4er
  • from %APPDATA%\microsoft\office\recent\license_ja.lnk to %APPDATA%\microsoft\office\recent\license_ja.lnk.rnsmcat4er
  • from %APPDATA%\microsoft\office\recent\protect.lnk to %APPDATA%\microsoft\office\recent\protect.lnk.rnsmcat4er
  • from %APPDATA%\microsoft\office\recent\templates.lnk to %APPDATA%\microsoft\office\recent\templates.lnk.rnsmcat4er
  • from %APPDATA%\microsoft\office\recent\virtual-machiene-introspection.lnk to %APPDATA%\microsoft\office\recent\virtual-machiene-introspection.lnk.rnsmcat4er
  • from %APPDATA%\microsoft\office\recent\vm introspection.lnk to %APPDATA%\microsoft\office\recent\vm introspection.lnk.rnsmcat4er
  • from %APPDATA%\icqm\icq\sounds\message.mp3 to %APPDATA%\icqm\icq\sounds\message.mp3.rnsmcat4er
  • from %APPDATA%\icqm\icq\video\video.swf to %APPDATA%\icqm\icq\video\video.swf.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\certificate revocation lists to %APPDATA%\opera software\opera stable\certificate revocation lists.rnsmcat4er
  • from %APPDATA%\telegram desktop\tdata\shortcuts-custom.json to %APPDATA%\telegram desktop\tdata\shortcuts-custom.json.rnsmcat4er
  • from %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini to %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini.rnsmcat4er
  • from %APPDATA%\mra\update\languages.hash to %APPDATA%\mra\update\languages.hash.rnsmcat4er
  • from %APPDATA%\mra\update\ver.txt to %APPDATA%\mra\update\ver.txt.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\cookies-journal to %APPDATA%\opera software\opera stable\cookies-journal.rnsmcat4er
  • from %APPDATA%\telegram desktop\tdata\shortcuts-default.json to %APPDATA%\telegram desktop\tdata\shortcuts-default.json.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\favicons to %APPDATA%\opera software\opera stable\favicons.rnsmcat4er
  • from %APPDATA%\telegram desktop\tdata\usertag to %APPDATA%\telegram desktop\tdata\usertag.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\favicons-journal to %APPDATA%\opera software\opera stable\favicons-journal.rnsmcat4er
  • from %APPDATA%\icqm\icq\database\citylist_en.csv to %APPDATA%\icqm\icq\database\citylist_en.csv.rnsmcat4er
  • from %APPDATA%\icqm\icq\dll\altergeo.msi to %APPDATA%\icqm\icq\dll\altergeo.msi.rnsmcat4er
  • from %APPDATA%\icqm\icq\database\citylist_kz.csv to %APPDATA%\icqm\icq\database\citylist_kz.csv.rnsmcat4er
  • from %APPDATA%\icqm\icq\database\citylist_ru.csv to %APPDATA%\icqm\icq\database\citylist_ru.csv.rnsmcat4er
  • from %APPDATA%\icqm\icq\fonts\segoesc.ttf to %APPDATA%\icqm\icq\fonts\segoesc.ttf.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\favorites.db-journal to %APPDATA%\opera software\opera stable\favorites.db-journal.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\history to %APPDATA%\opera software\opera stable\history.rnsmcat4er
  • from %APPDATA%\icqm\icq\database\citylist_tr.csv to %APPDATA%\icqm\icq\database\citylist_tr.csv.rnsmcat4er
  • from %APPDATA%\icqm\icq\database\citylist_ua.csv to %APPDATA%\icqm\icq\database\citylist_ua.csv.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\history provider cache to %APPDATA%\opera software\opera stable\history provider cache.rnsmcat4er
  • from %APPDATA%\icqm\icq\sounds\auth.mp3 to %APPDATA%\icqm\icq\sounds\auth.mp3.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\history-journal to %APPDATA%\opera software\opera stable\history-journal.rnsmcat4er
  • from %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\cookies to %APPDATA%\opera software\opera stable\cookies.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\extension state\lock to %APPDATA%\opera software\opera stable\extension state\lock.rnsmcat4er
  • from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\f8401b27-0c7a-4d0f-80a5-9679c6328419 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\f8401b27-0c7a-4d0f-80a5-9679c6328419.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s003.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s003.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s002.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s002.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\can't say-shut up.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\can't say-shut up.gif.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles\wjj9aet2.default\places.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\places.sqlite.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\dance.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\dance.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s004.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s004.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\06a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\06a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\aaa.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\aaa.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\blum1.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\blum1.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s003.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s003.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\beer.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\beer.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s003.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s003.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s005.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s005.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\07a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\07a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\devil.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\devil.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\biggrin.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\biggrin.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\cool.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\cool.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\love.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\love.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\kisses.swf to %APPDATA%\icqm\icq\smiles\flash\kisses.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\bad.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\bad.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_mouse.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_mouse.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\joy.swf to %APPDATA%\icqm\icq\smiles\flash\joy.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s001.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s001.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\02.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\02.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blushing.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blushing.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\03a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\03a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\book.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\book.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\angel.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\angel.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\bad.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\bad.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_paper.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_paper.gif.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles\wjj9aet2.default\parent.lock to %APPDATA%\thunderbird\profiles\wjj9aet2.default\parent.lock.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\bomb.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\bomb.gif.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles\wjj9aet2.default\permissions.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\permissions.sqlite.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s002.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s002.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s002.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s002.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\04b.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\04b.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\biggrin.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\biggrin.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s001.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s001.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\beback.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\beback.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blinking.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blinking.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\could.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\could.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s004.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s004.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\eat.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\eat.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\11a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\11a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\blush.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\blush.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\bazilio.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\bazilio.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf to %APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\fingal.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\fingal.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s008.gif.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles\wjj9aet2.default\session.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\session.json.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles\wjj9aet2.default\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\sessioncheckpoints.json.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles\wjj9aet2.default\times.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\times.json.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\flowr.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\flowr.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\gg.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gg.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\cray.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\cray.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\gg2.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gg2.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s009.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s009.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\devil.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\devil.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s008.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s007.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s007.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\10a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\10a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\blush.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\blush.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s004.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s004.gif.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles\wjj9aet2.default\prefs.js to %APPDATA%\thunderbird\profiles\wjj9aet2.default\prefs.js.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\kot_cool.swf to %APPDATA%\icqm\icq\smiles\flash\kot_cool.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\08a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\08a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\blum.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\blum.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\fight.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\fight.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\crying.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\crying.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\bomb.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\bomb.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\amazed.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\amazed.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s005.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s005.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s007.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s007.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\angry.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\angry.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\bodun.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\bodun.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s006.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s006.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\09a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\09a.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\ass.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\ass.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf to %APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s006.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s006.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s006.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s006.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s001.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s001.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf to %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\drako_love.swf to %APPDATA%\icqm\icq\smiles\flash\drako_love.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf to %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite.rnsmcat4er
  • from %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\session.dbak to %APPDATA%\opera software\opera stable\session.dbak.rnsmcat4er
  • from %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\siteprefs.json to %APPDATA%\opera software\opera stable\siteprefs.json.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf to %APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\ssdfp1652.1.1724122967 to %APPDATA%\opera software\opera stable\ssdfp1652.1.1724122967.rnsmcat4er
  • from %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf to %APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\ssdfp2216.0.2078311798 to %APPDATA%\opera software\opera stable\ssdfp2216.0.2078311798.rnsmcat4er
  • from %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\duh.swf to %APPDATA%\icqm\icq\smiles\flash\duh.swf.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\ssdfp2512.4.1739910927 to %APPDATA%\opera software\opera stable\ssdfp2512.4.1739910927.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\ssdfp2544.3.670597881 to %APPDATA%\opera software\opera stable\ssdfp2544.3.670597881.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf to %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\devochka.swf to %APPDATA%\icqm\icq\smiles\flash\devochka.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.ini to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.ini.rnsmcat4er
  • from %APPDATA%\microsoft\internet explorer\quick launch\qip 2012.lnk to %APPDATA%\microsoft\internet explorer\quick launch\qip 2012.lnk.rnsmcat4er
  • from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\preferred to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\preferred.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\database\citylist_tr.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_tr.csv.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles\wjj9aet2.default\compatibility.ini to %APPDATA%\thunderbird\profiles\wjj9aet2.default\compatibility.ini.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\session.db-journal to %APPDATA%\opera software\opera stable\session.db-journal.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.json.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\database\citylist_ua.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_ua.csv.rnsmcat4er
  • from %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk to %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk.rnsmcat4er
  • from %APPDATA%\microsoft\internet explorer\quick launch\winamp.lnk to %APPDATA%\microsoft\internet explorer\quick launch\winamp.lnk.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\database\citylist_uz.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_uz.csv.rnsmcat4er
  • from %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk to %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\beback.swf to %APPDATA%\icqm\icq\smiles\flash\beback.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\beer.swf to %APPDATA%\icqm\icq\smiles\flash\beer.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\bodun.swf to %APPDATA%\icqm\icq\smiles\flash\bodun.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\boo.swf to %APPDATA%\icqm\icq\smiles\flash\boo.swf.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage-journal.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\healthreport.sqlite to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\healthreport.sqlite.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\canthearu.swf to %APPDATA%\icqm\icq\smiles\flash\canthearu.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\chillout.swf to %APPDATA%\icqm\icq\smiles\flash\chillout.swf.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\thumbnails.db-journal to %APPDATA%\opera software\opera stable\thumbnails.db-journal.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf to %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\transportsecurity to %APPDATA%\opera software\opera stable\transportsecurity.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\xulstore.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\xulstore.json.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\information.swf to %APPDATA%\icqm\icq\smiles\flash\information.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_hand.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_hand.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\akitaka.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\akitaka.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\air_kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\air_kiss.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_lick.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_lick.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\01.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\01.gif.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles\wjj9aet2.default\foldertree.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\foldertree.json.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles\wjj9aet2.default\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\global-messages-db.sqlite.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\angel.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\angel.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\angel.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\angel.swf.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles\wjj9aet2.default\history.mab to %APPDATA%\thunderbird\profiles\wjj9aet2.default\history.mab.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\bad_cold.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\bad_cold.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_meow.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_meow.gif.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\user.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\user.js.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sitesecurityservicestate.txt.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\times.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\times.json.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessioncheckpoints.json.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\gangsta.swf to %APPDATA%\icqm\icq\smiles\flash\gangsta.swf.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\visited links to %APPDATA%\opera software\opera stable\visited links.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\web data to %APPDATA%\opera software\opera stable\web data.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\web data-journal to %APPDATA%\opera software\opera stable\web data-journal.rnsmcat4er
  • from %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\kiks.yandex.ru\fuid01.sol to %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\kiks.yandex.ru\fuid01.sol.rnsmcat4er
  • from %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\microsoft\network\connections\pbk\_hiddenpbk\rasphone.pbk to %APPDATA%\microsoft\network\connections\pbk\_hiddenpbk\rasphone.pbk.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\car.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\car.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\flash\guby.swf to %APPDATA%\icqm\icq\smiles\flash\guby.swf.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\statuses\set01\71_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\71_xp.ico.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\could.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\could.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.ini to %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.ini.rnsmcat4er
  • from %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.json.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js.rnsmcat4er
  • from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_attack.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_attack.gif.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\revocations.txt to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\revocations.txt.rnsmcat4er
  • from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\search.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\search.json.rnsmcat4er
  • from %APPDATA%\opera software\opera stable\update_prefs.json to %APPDATA%\opera software\opera stable\update_prefs.json.rnsmcat4er
  • from %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif.rnsmcat4er
  • from %APPDATA%\mail.ru\agent\mra\smiles\flash\laugh.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\laugh.swf.rnsmcat4er
Modifies the following files
  • %HOMEPATH%\documents\desktop.ini.rnsmcat4er
  • %ALLUSERSPROFILE%\mozilla\logs\maintenanceservice-uninstall.log.rnsmcat4er
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi.rnsmcat4er
  • %ALLUSERSPROFILE%\microsoft help\hx_1033_mvalidator.hxd.rnsmcat4er
  • %ALLUSERSPROFILE%\microsoft\office\documentrepository.ico.rnsmcat4er
  • C:\far2\farcze.lng.rnsmcat4er
  • C:\users\default\ntuser.dat.log1.rnsmcat4er
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1500820082.msp.rnsmcat4er
  • %ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp.rnsmcat4er
  • C:\users\desktop.ini.rnsmcat4er
  • C:\far2\far.map.rnsmcat4er
  • %ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmp.rnsmcat4er
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.rnsmcat4er
  • %ALLUSERSPROFILE%\mozilla\logs\maintenanceservice-install.log.rnsmcat4er
  • %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\tokens.dat.rnsmcat4er
  • %ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico.rnsmcat4er
  • %ALLUSERSPROFILE%\microsoft help\hx_1033_mtoc_hx.hxh.rnsmcat4er
  • C:\far2\clearpluginscache.cmd.rnsmcat4er
  • C:\far2\changelog_eng.rnsmcat4er
  • C:\users\default\ntuser.dat.log.rnsmcat4er
  • C:\far2\changelog.rnsmcat4er
  • %ALLUSERSPROFILE%\microsoft help\hx_1033_mkwd_namedurl.hxw.rnsmcat4er
  • %ALLUSERSPROFILE%\microsoft help\hx_1033_mkwd_k.hxw.rnsmcat4er
  • C:\users\default\ntuser.dat.rnsmcat4er
  • %ALLUSERSPROFILE%\microsoft help\hx.hxn.rnsmcat4er
  • %ALLUSERSPROFILE%\microsoft toolkit\settings.xml.rnsmcat4er
  • %ALLUSERSPROFILE%\ntuser.pol.rnsmcat4er
  • C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.rnsmcat4er
  • %ALLUSERSPROFILE%\microsoft\crypto\keys\68383f0e45dd9b02f69c4041b082ee57_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.rnsmcat4er
  • %ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\acrordrdcupd1500920077.msp.rnsmcat4er
Modifies multiple files.
Substitutes the following files
  • %ALLUSERSPROFILE%\Microsoft\User Account Pictures\user.dat
  • %APPDATA%\Opera Software\Opera Stable\opera_shutdown_ms.txt
  • %APPDATA%\Winamp\Plugins\ml\ml_online.ini
  • %LOCALAPPDATA%\Thunderbird\Profiles\wjj9aet2.default\_CACHE_CLEAN_
  • %LOCALAPPDATA%\Google\Chrome\User Data\Default\History Provider Cache
  • %APPDATA%\Microsoft\Network\Connections\Pbk\_hiddenPbk\rasphone.pbk
  • %APPDATA%\Thunderbird\Profiles\wjj9aet2.default\folderTree.json
  • %APPDATA%\Thunderbird\Profiles\wjj9aet2.default\parent.lock
  • %APPDATA%\Thunderbird\Profiles\wjj9aet2.default\virtualFolders.dat
  • %LOCALAPPDATA%\Microsoft\Internet Explorer\DOMStore\G32IFQHJ\helpx.adobe[1].xml
  • %LOCALAPPDATA%\Google\Chrome\User Data\Default\TransportSecurity
  • %LOCALAPPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\_CACHE_CLEAN_
  • %LOCALAPPDATA%\Google\Chrome\User Data\Default\GCM Store\000003.log
  • %LOCALAPPDATA%\Google\Chrome\User Data\Default\GCM Store\000004.log
  • %LOCALAPPDATA%\Google\Chrome\User Data\Default\GCM Store\000005.log
  • %LOCALAPPDATA%\Google\Chrome\User Data\Default\GCM Store\LOCK
  • %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extension State\LOCK
  • %LOCALAPPDATA%\Google\Chrome\User Data\Default\JumpListIcons\B8E2.tmp
  • %LOCALAPPDATA%\Google\Chrome\User Data\Default\JumpListIconsOld\8A6C.tmp
  • %LOCALAPPDATA%\Google\Chrome\User Data\Default\JumpListIcons\B8E3.tmp
  • %LOCALAPPDATA%\Google\Chrome\User Data\Default\JumpListIconsOld\8A6D.tmp
  • %APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\webapps\webapps.json
  • %APPDATA%\Opera Software\Opera Stable\Extension State\LOCK
  • %LOCALAPPDATA%\Google\Chrome\User Data\Default\JumpListIcons\B8E4.tmp
  • %APPDATA%\Adobe\Acrobat\DC\Preferences\AutoFillDefaults.dat
  • %LOCALAPPDATA%\Google\Chrome\User Data\chrome_shutdown_ms.txt
  • %ALLUSERSPROFILE%\Microsoft Help\Hx_1033_MValidator.Lck
  • %ALLUSERSPROFILE%\microsoft help\hx_1033_mvalidator.lck.rnsmcat4er
  • C:\Users\Default\NTUSER.DAT.LOG2
  • %ALLUSERSPROFILE%\microsoft\user account pictures\user.dat.rnsmcat4er
  • %ALLUSERSPROFILE%\Microsoft\RAC\StateData\RacMetaData.dat
  • %ALLUSERSPROFILE%\Microsoft Help\MS.Dexplore_1033_MValidator.Lck
  • %ALLUSERSPROFILE%\microsoft help\ms.dexplore_1033_mvalidator.lck.rnsmcat4er
  • %ALLUSERSPROFILE%\Microsoft Help\MS.NETFrameworkSDKv1.1_1033_MValidator.Lck
  • %APPDATA%\ICQM\vplog.dat
  • %ALLUSERSPROFILE%\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.lck.rnsmcat4er
  • %ALLUSERSPROFILE%\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.Lck
  • %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mvalidator.lck.rnsmcat4er
  • %APPDATA%\Mail.Ru\Agent\vplog.dat
  • %APPDATA%\Microsoft\UProof\CUSTOM.DIC
  • %APPDATA%\Thunderbird\Crash Reports\InstallTime20150330093429
  • %APPDATA%\Microsoft\UProof\ExcludeDictionaryEN0409.lex
  • %APPDATA%\Microsoft\UProof\ExcludeDictionaryEN0809.lex
  • %APPDATA%\ICQ-Profile\Update\vvlog.dat
  • %APPDATA%\Mra\Update\vvlog.dat
  • %APPDATA%\Telegram Desktop\tdata\usertag
  • %APPDATA%\Mozilla\Firefox\Crash Reports\InstallTime20150415140819
  • %LOCALAPPDATA%\Google\Chrome\User Data\First Run
  • %LOCALAPPDATA%\Google\Chrome\User Data\Default\JumpListIcons\B8E5.tmp
Changes user data files extensions (Trojan.Encoder).

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android