Trojan.Encoder.35526

Technical Information

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\xi\lqxfet.sre
%APPDATA%\icqm\icq\translation\how_fix_files.htm
%APPDATA%\microsoft\dbgclr\7.1\how_fix_files.htm
%APPDATA%\microsoft\internet explorer\quick launch\how_fix_files.htm
%APPDATA%\icqm\icq\sounds\how_fix_files.htm
%LOCALAPPDATA%\adobe\color\profiles\how_fix_files.htm
%APPDATA%\icqm\icq\video\how_fix_files.htm
C:\far2\pluginsdk\headers.c\how_fix_files.htm
%APPDATA%\microsoft\msdn\7.0\how_fix_files.htm
%APPDATA%\microsoft\office\recent\how_fix_files.htm
%LOCALAPPDATA%\microsoft\internet explorer\how_fix_files.htm
C:\far2\plugins\compare\how_fix_files.htm
%LOCALAPPDATA%\microsoft\device metadata\how_fix_files.htm
%LOCALAPPDATA%\google\chrome\user data\how_fix_files.htm
%APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\how_fix_files.htm
%LOCALAPPDATA%\microsoft\media player\how_fix_files.htm
%APPDATA%\adobe\acrobat\dc\security\how_fix_files.htm
%APPDATA%\opera software\opera stable\databases\how_fix_files.htm
%APPDATA%\opera software\opera stable\dictionaries\how_fix_files.htm
C:\far2\plugins\ftp\lib\how_fix_files.htm
%APPDATA%\adobe\acrobat\dc\preferences\how_fix_files.htm
%APPDATA%\opera software\opera stable\extension state\how_fix_files.htm
%APPDATA%\icqm\icq\smiles\flash\how_fix_files.htm
%APPDATA%\icqm\icq\fonts\how_fix_files.htm
%APPDATA%\icqm\icq\smiles\how_fix_files.htm
%APPDATA%\icqm\icq\dll\how_fix_files.htm
C:\far2\plugins\tmppanel\how_fix_files.htm
%APPDATA%\icqm\icq\database\how_fix_files.htm
%LOCALAPPDATA%low\oracle\java\au\how_fix_files.htm
%APPDATA%\microsoft\publisher building blocks\how_fix_files.htm
%APPDATA%\telegram desktop\tdata\how_fix_files.htm
%APPDATA%\microsoft\templates\how_fix_files.htm
C:\far2\plugins\align\how_fix_files.htm
%APPDATA%\mra\update\how_fix_files.htm
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\how_fix_files.htm
%APPDATA%\adobe\acrobat\dc\how_fix_files.htm
C:\far2\plugins\autowrap\how_fix_files.htm
%LOCALAPPDATA%low\sun\java\deployment\how_fix_files.htm
%APPDATA%\icqm\icq\graphics\phone\how_fix_files.htm
%APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\how_fix_files.htm
C:\far2\plugins\brackets\how_fix_files.htm
C:\far2\plugins\emenu\how_fix_files.htm
C:\far2\plugins\macroview\how_fix_files.htm
C:\far2\plugins\arclite\how_fix_files.htm
C:\far2\plugins\hlfviewer\how_fix_files.htm
C:\far2\plugins\editcase\how_fix_files.htm
C:\far2\plugins\farcmds\how_fix_files.htm
C:\far2\plugins\network\how_fix_files.htm
C:\far2\plugins\drawline\how_fix_files.htm
C:\far2\plugins\filecase\how_fix_files.htm
C:\far2\plugins\proclist\how_fix_files.htm
%APPDATA%\mirc\scripts\how_fix_files.htm
C:\far2\plugins\ftp\how_fix_files.htm
%APPDATA%\mail.ru\agent\mra\dll\how_fix_files.htm
%APPDATA%\mail.ru\agent\mra\smiles\how_fix_files.htm
%APPDATA%\mail.ru\agent\mra\fonts\how_fix_files.htm
%APPDATA%\icqm\icq\html\bg\loading\how_fix_files.htm
%APPDATA%\icqm\icq\html\kz\jabber\how_fix_files.htm
%APPDATA%\icqm\icq\html\kz\loading\how_fix_files.htm
%APPDATA%\icqm\icq\html\pt\jabber\how_fix_files.htm
%APPDATA%\icqm\icq\html\pt\loading\how_fix_files.htm
%APPDATA%\icqm\icq\html\ru\error\how_fix_files.htm
%APPDATA%\icqm\icq\html\ru\jabber\how_fix_files.htm
%APPDATA%\icqm\icq\html\bg\error\how_fix_files.htm
%APPDATA%\icqm\icq\html\cz\loading\how_fix_files.htm
%APPDATA%\icqm\icq\html\ru\loading\how_fix_files.htm
%APPDATA%\icqm\icq\html\tr\error\how_fix_files.htm
%APPDATA%\icqm\icq\html\tr\loading\how_fix_files.htm
%LOCALAPPDATA%low\microsoft\internet explorer\services\how_fix_files.htm
%APPDATA%\icqm\icq\html\ua\error\how_fix_files.htm
%APPDATA%\icqm\icq\html\uz\error\how_fix_files.htm
%APPDATA%\icqm\icq\html\uz\jabber\how_fix_files.htm
%APPDATA%\icqm\icq\html\uz\loading\how_fix_files.htm
%APPDATA%\icqm\icq\html\tr\jabber\how_fix_files.htm
%APPDATA%\icqm\icq\html\en\jabber\how_fix_files.htm
%APPDATA%\icqm\icq\html\en\error\how_fix_files.htm
%APPDATA%\icqm\icq\html\en\loading\how_fix_files.htm
%APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\kiks.yandex.ru\how_fix_files.htm
%APPDATA%\mail.ru\agent\mra\graphics\phone\how_fix_files.htm
%APPDATA%\icqm\icq\smiles\smiles\8march\how_fix_files.htm
%APPDATA%\icqm\icq\html\kz\error\how_fix_files.htm
%LOCALAPPDATA%\microsoft\msdn\7.0\how_fix_files.htm
%APPDATA%\icqm\icq\html\cz\jabber\how_fix_files.htm
%APPDATA%\opera software\opera stable\jump list iconsold\how_fix_files.htm
%APPDATA%\mail.ru\agent\mra\video\how_fix_files.htm
%APPDATA%\mail.ru\agent\mra\translation\how_fix_files.htm
%APPDATA%\thunderbird\profiles\wjj9aet2.default\how_fix_files.htm
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\how_fix_files.htm
%APPDATA%\microsoft\document building blocks\1033\14\how_fix_files.htm
%APPDATA%\mail.ru\agent\mra\sounds\how_fix_files.htm
%APPDATA%\opera software\opera stable\jump list icons\how_fix_files.htm
%APPDATA%\winamp\plugins\milkdrop2\how_fix_files.htm
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\how_fix_files.htm
%LOCALAPPDATA%\microsoft\dbgclr\7.1\how_fix_files.htm
%APPDATA%\icqm\icq\smiles\smiles\how_fix_files.htm
%APPDATA%\icqm\icq\html\ua\loading\how_fix_files.htm
%APPDATA%\icqm\icq\html\de\jabber\how_fix_files.htm
%APPDATA%\opera software\opera stable\local storage\how_fix_files.htm
%LOCALAPPDATA%\microsoft\feeds\feeds for united states~\how_fix_files.htm
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\how_fix_files.htm
%LOCALAPPDATA%\microsoft\office\onetconfig\how_fix_files.htm
C:\far2\pluginsdk\headers.pas\how_fix_files.htm
%APPDATA%\mail.ru\agent\mra\database\how_fix_files.htm
%LOCALAPPDATA%\microsoft\internet explorer\domstore\how_fix_files.htm
%APPDATA%\icqm\icq\html\bg\jabber\how_fix_files.htm
%APPDATA%\icqm\icq\html\cz\error\how_fix_files.htm
%APPDATA%\icqm\icq\html\de\error\how_fix_files.htm
%LOCALAPPDATA%\google\chrome\user data\default\how_fix_files.htm
%APPDATA%\icqm\icq\html\de\loading\how_fix_files.htm
%APPDATA%\icqm\icq\html\pt\error\how_fix_files.htm
%APPDATA%\opera software\opera stable\how_fix_files.htm
C:\far2\fexcept\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1049\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1050\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1040\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\msdn\7.0\2052\how_fix_files.htm
C:\far2\addons\colors\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\dbgclr\7.1\1033\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1033\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1031\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1041\how_fix_files.htm
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\how_fix_files.htm
C:\users\public\desktop\how_fix_files.htm
%HOMEPATH%\desktop\how_fix_files.htm
%HOMEPATH%\downloads\how_fix_files.htm
%HOMEPATH%\favorites\how_fix_files.htm
%HOMEPATH%\music\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1036\how_fix_files.htm
C:\far2\documentation\eng\how_fix_files.htm
%HOMEPATH%\links\how_fix_files.htm
%ALLUSERSPROFILE%\xi\lqxfet.sre.rnsmcat4er
C:\far2\encyclopedia\how_fix_files.htm
C:\users\public\recorded tv\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\rac\statedata\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1046\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\how_fix_files.htm
%ALLUSERSPROFILE%\adobe\arm\s\how_fix_files.htm
C:\far2\addons\how_fix_files.htm
%ALLUSERSPROFILE%\xi\gfuo.atl
%TEMP%\xuopdg.nlu
%HOMEPATH%\documents\how_fix_files.htm
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft toolkit\how_fix_files.htm
%ALLUSERSPROFILE%\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft help\how_fix_files.htm
C:\users\default\how_fix_files.htm
C:\far2\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\office\how_fix_files.htm
C:\users\public\videos\how_fix_files.htm
%HOMEPATH%\contacts\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\how_fix_files.htm
C:\users\how_fix_files.htm
C:\totalcmd\how_fix_files.htm
%ALLUSERSPROFILE%\mozilla\logs\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\crypto\keys\how_fix_files.htm
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\how_fix_files.htm
%ALLUSERSPROFILE%\xi\gfuo.atl.rnsmcat4er
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\how_fix_files.htm
%HOMEPATH%\how_fix_files.htm
%ALLUSERSPROFILE%\xi\how_fix_files.htm
C:\users\public\how_fix_files.htm
%TEMP%\ddaad.aux
%ALLUSERSPROFILE%\microsoft\user account pictures\how_fix_files.htm
%HOMEPATH%\pictures\how_fix_files.htm
%HOMEPATH%\saved games\how_fix_files.htm
%HOMEPATH%\searches\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\how_fix_files.htm
%APPDATA%\icq-profile\how_fix_files.htm
C:\far2\documentation\rus\how_fix_files.htm
C:\users\public\libraries\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\how_fix_files.htm
C:\users\public\pictures\sample pictures\how_fix_files.htm
%APPDATA%\mirc\how_fix_files.htm
%APPDATA%\mra\how_fix_files.htm
%APPDATA%\qipguard\how_fix_files.htm
%APPDATA%\thunderbird\how_fix_files.htm
%APPDATA%\telegram desktop\how_fix_files.htm
C:\users\public\music\sample music\how_fix_files.htm
%LOCALAPPDATA%\adobe\acrobat\dc\how_fix_files.htm
%APPDATA%\microsoft\mmc\how_fix_files.htm
%LOCALAPPDATA%\adobe\color\how_fix_files.htm
%APPDATA%\icq-profile\base\how_fix_files.htm
%APPDATA%\winamp\how_fix_files.htm
%APPDATA%\adobe\logtransport2\how_fix_files.htm
%APPDATA%\mozilla\firefox\how_fix_files.htm
C:\totalcmd\language\how_fix_files.htm
%APPDATA%\microsoft\office\how_fix_files.htm
%APPDATA%\mra\base\how_fix_files.htm
%APPDATA%\icq-profile\update\how_fix_files.htm
%LOCALAPPDATA%low\adobe\acrobat\dc\how_fix_files.htm
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\how_fix_files.htm
%HOMEPATH%\favorites\microsoft websites\how_fix_files.htm
C:\far2\addons\xlat\russian\how_fix_files.htm
%HOMEPATH%\favorites\links for united states\how_fix_files.htm
%HOMEPATH%\videos\how_fix_files.htm
C:\users\public\pictures\how_fix_files.htm
C:\far2\addons\macros\how_fix_files.htm
C:\far2\addons\setup\how_fix_files.htm
C:\far2\addons\shell\how_fix_files.htm
C:\far2\addons\xlat\how_fix_files.htm
C:\far2\addons\colors\custom_highlighting\how_fix_files.htm
C:\far2\addons\colors\default_highlighting\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1042\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1028\how_fix_files.htm
%ALLUSERSPROFILE%\sun\java\java update\how_fix_files.htm
%APPDATA%\microsoft\protect\how_fix_files.htm
%LOCALAPPDATA%\applicationhistory\how_fix_files.htm
%HOMEPATH%\favorites\msn websites\how_fix_files.htm
C:\far2\encyclopedia\tap\how_fix_files.htm
C:\users\public\recorded tv\sample media\how_fix_files.htm
%HOMEPATH%\favorites\links\how_fix_files.htm
C:\users\public\videos\sample videos\how_fix_files.htm
C:\users\public\music\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\msdn\7.0\3082\how_fix_files.htm
C:\users\public\downloads\how_fix_files.htm
C:\users\public\documents\how_fix_files.htm
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\how_fix_files.htm
%LOCALAPPDATA%\how_fix_files.htm
%APPDATA%\ghisler\how_fix_files.htm
%APPDATA%\icqm\icq\smiles\smiles\animated\how_fix_files.htm

Moves the following files

from %ALLUSERSPROFILE%\xi\gfuo.atl to %ALLUSERSPROFILE%\xi\gfuo.atl.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\coolguy.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\coolguy.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set06\s017.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s017.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\valentine\dont_be_late.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\dont_be_late.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_away.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_away.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_busy.ico to %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_busy.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\101_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\101_xp.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_chat.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_chat.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\valentine\in_love.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\in_love.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_connecting.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_connecting.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_dnd.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_dnd.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\valentine\jealousy.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\jealousy.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\102.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\102.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_gray.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_gray.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set06\s018.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s018.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\102_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\102_xp.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_invisible.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_invisible.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_gray.ico to %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_gray.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_offline.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_offline.ico.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_love.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_love.swf.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\crashes\store.json.mozlz4.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\14a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\14a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\kot_wow.swf to %APPDATA%\icqm\icq\smiles\flash\kot_wow.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\shout.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\shout.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\i_am_so_happy.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\i_am_so_happy.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set06\s012.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s012.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf to %APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_away.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_away.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_busy.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_busy.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set06\s013.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s013.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_gray.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_gray.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_offline.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_offline.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set06\s014.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s014.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\smile.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_away.ico to %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_away.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set06\s015.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s015.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_online.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_online.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\13a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\13a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\unknw.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\unknw.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\valentine\broken_heart.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\broken_heart.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_koster.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_koster.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set06\s016.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s016.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\101.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\101.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_online.ico to %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_online.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\100_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\100_xp.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\104_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\104_xp.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\disappointed.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\disappointed.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\fist.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\fist.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\15a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\15a.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_snegyrka.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_snegyrka.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\likeu.swf to %APPDATA%\icqm\icq\smiles\flash\likeu.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\13.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\13.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\valentine\kissed.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\kissed.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\fuck.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\fuck.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set06\s020.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s020.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\valentine\lets_play.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\lets_play.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\icq\seekfriends.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\seekfriends.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\icq\seekfriends_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\seekfriends_xp.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\lol.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\lol.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\heart.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\heart.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\valentine\on_wings.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\on_wings.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\hm.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\hm.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\icq\status_mobile.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\status_mobile.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\103_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\103_xp.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\12_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\12_xp.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\104.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\104.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\12.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\12.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\103.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\103.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_online.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_online.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\wacko2.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\wacko2.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_wrong_data.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\icq_status_wrong_data.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\crocodile.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\crocodile.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_offline.ico to %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_offline.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\cry.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\cry.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\detzl.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\detzl.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_online.ico to %APPDATA%\icqm\icq\smiles\statuses\vk\vkontakte_online.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\11.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\11.ico.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\bookmarkbackups\bookmarks-2022-04-14_14_x5qkry9yysawyostzmcdfa==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\bookmarkbackups\bookmarks-2022-04-14_14_x5qkry9yysawyostzmcdfa==.jsonlz4.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\11_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\11_xp.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\devil.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\devil.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\wink.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\wink.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\krizis.swf to %APPDATA%\icqm\icq\smiles\flash\krizis.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\die.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\die.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\valentine\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\kiss.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\yahoo.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\yahoo.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\laugh.swf to %APPDATA%\icqm\icq\smiles\flash\laugh.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set06\s019.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s019.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss3.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss3.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s011.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s011.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_opyatnica.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_opyatnica.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\gamer.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\gamer.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\fool.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\fool.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\crazy.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\crazy.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\boo.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\boo.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set04\s014.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s014.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\give_rose.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\give_rose.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\rainbow.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\rainbow.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\good.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\good.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s016.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s016.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\kiss_mini.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\kiss_mini.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set04\s015.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s015.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s017.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s017.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\red.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\red.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\man_in_love.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\man_in_love.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sad.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s018.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s018.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set04\s016.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s016.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set06\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s008.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\mocking.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\mocking.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\music.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\music.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\cool.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\cool.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\shok.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\shok.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set04\s013.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s013.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\poison.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\poison.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\hungry.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\hungry.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\s008.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\s008.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s012.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s012.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\dance.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\dance.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\kiss.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s013.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s013.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s014.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s014.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\diablo.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\diablo.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\love.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\love.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\pistolet.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\pistolet.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s015.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s015.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\dirol.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\dirol.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\bye2.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\bye2.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\12a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\12a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set04\s009.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s009.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\drinks.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\drinks.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set04\s010.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s010.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\facepalm.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\facepalm.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set04\s011.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s011.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set04\s012.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s012.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_offline.ico to %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_offline.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\100.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\100.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\cry.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\cry.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_heart.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_heart.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_rose.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_rose.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\chillout.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\chillout.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\good.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\good.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\hang1.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\hang1.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\devochka.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\devochka.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\hi.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\hi.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\biganger.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\biganger.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\ireful.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\ireful.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\biggrin.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\biggrin.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\blink.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\blink.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\kot_obida.swf to %APPDATA%\icqm\icq\smiles\flash\kot_obida.swf.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_bolnoy.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_bolnoy.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set06\s010.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s010.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\bullshit.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\bullshit.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\scratch_one-s_head.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\scratch_one-s_head.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set06\s011.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s011.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_gray.ico to %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_gray.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\nea.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\nea.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\girl_angel.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\girl_angel.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s020.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s020.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\sad.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s019.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s019.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\sing.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sing.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\pardon.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\pardon.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\skuka.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\skuka.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\rofl.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\rofl.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\sleep.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sleep.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\rolleyes.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\rolleyes.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\dance.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\dance.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\smile.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\icq\24bit.ico to %APPDATA%\icqm\icq\smiles\statuses\icq\24bit.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\tongue.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\tongue.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\victory.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\victory.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\diablo.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\diablo.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\wonder.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\wonder.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set06\s009.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s009.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_away.ico to %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_away.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\bee.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\bee.gif.rnsmcat4er
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\webappsstore.sqlite.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\drinks.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\drinks.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_busy.ico to %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_busy.ico.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\canthearu.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\canthearu.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\history.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\history.gif.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\state.json.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\16a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\16a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thank you.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thank you.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\html\ru\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\ru\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\tears.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\tears.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf to %APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_away.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_away.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\think.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\think.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_chat.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_chat.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\vampire.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\vampire.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thumbs up.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thumbs up.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\66.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\66.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_dnd.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_dnd.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\victory.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\victory.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\zloradstvo.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\zloradstvo.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\66_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\66_xp.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\tongue out.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\tongue out.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\67.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\67.ico.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\html\pt\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\pt\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\html\tr\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\tr\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_gray.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_gray.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\32a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\32a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_offline.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_offline.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\31a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\31a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\surprised.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\surprised.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\unknown.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\unknown.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\html\kz\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\kz\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\wacko1.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\wacko1.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\sceptic.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\sceptic.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\sobaka.swf to %APPDATA%\icqm\icq\smiles\flash\sobaka.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\shy.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\shy.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\sad.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\30a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\30a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_wrong_data.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_wrong_data.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\wink.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\wink.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\scream.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\scream.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\65.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\65.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\smile.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\sleepy.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\sleepy.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\kisses.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kisses.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\yahoo.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\yahoo.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\stop.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\stop.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\yes.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\yes.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\65_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\65_xp.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\smile.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_online.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_online.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\67_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\67_xp.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_offline.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_offline.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf to %APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\71.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\71.ico.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_attack.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_attack.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\angel.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\angel.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\appl.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\appl.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\beauty.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\beauty.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\beer.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\beer.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\blew.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\blew.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\book.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\book.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\car.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\car.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\36a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\36a.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_hand.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_hand.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\krizis.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\krizis.swf.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_lick.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\cat_lick.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\cry.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\cry.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\dance.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\dance.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\air_kiss.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\air_kiss.gif.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\webapps.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\webapps.json.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_wow.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_wow.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_invisible.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_invisible.ico.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\html\ua\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\ua\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\70_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\70_xp.ico.rnsmcat4er
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\store.json.mozlz4.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\html\uz\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\uz\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\68.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\68.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\33a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\33a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\34a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\34a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\sorry.swf to %APPDATA%\icqm\icq\smiles\flash\sorry.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\68_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\68_xp.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\69.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\69.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\69_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\69_xp.ico.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_goodbye.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_goodbye.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_online.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_status_online.ico.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_nedutza.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_nedutza.swf.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\previous.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\previous.js.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\70.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\70.ico.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\recovery.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\recovery.js.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_obida.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_obida.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\tank.swf to %APPDATA%\icqm\icq\smiles\flash\tank.swf.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\upgrade.js-20150415140819 to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\upgrade.js-20150415140819.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_cool.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_cool.swf.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_spasibo.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\kot_spasibo.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\56.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\56.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\13_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\13_xp.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\sorry.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\sorry.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\nea.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\nea.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\pardon.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\pardon.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\kukes.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\kukes.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\rofl.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\rofl.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\59_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\59_xp.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\falling asleep.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\falling asleep.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\19a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\19a.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\gangsta.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\gangsta.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\sad.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\gross.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\gross.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\20a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\20a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\21a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\21a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\laughter.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\laughter.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\in love.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\in love.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\22a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\22a.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\html\bg\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\bg\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kiss.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\59.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\59.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\valentine\want_you.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\want_you.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_right.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_right.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\drinking.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\drinking.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\guby.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\guby.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\64_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\64_xp.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\kiss.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\valentine\undress.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\undress.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\56_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\56_xp.ico.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_zombie.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\drako_zombie.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\mad dog.swf to %APPDATA%\icqm\icq\smiles\flash\mad dog.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\57.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\57.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\57_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\57_xp.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\missyou.swf to %APPDATA%\icqm\icq\smiles\flash\missyou.swf.rnsmcat4er
from %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol to %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\58.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\58.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\58_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\58_xp.ico.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\duh.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\duh.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\mad.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\mad.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\man_in_love.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\man_in_love.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\mocking.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\mocking.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\17a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\17a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_left.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_left.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\music.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\music.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\29a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\29a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\23a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\23a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\60_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\60_xp.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\plug.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\plug.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\serdze.swf to %APPDATA%\icqm\icq\smiles\flash\serdze.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\shout.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\shout.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\26a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\26a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\really.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\really.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\64.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\64.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\skratch.swf to %APPDATA%\icqm\icq\smiles\flash\skratch.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\mad.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\mad.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\smeh.swf to %APPDATA%\icqm\icq\smiles\flash\smeh.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\27a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\27a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\nothing to say.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\nothing to say.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\rrr.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\rrr.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\smile.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_connecting.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_connecting.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\28a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\28a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_gray.ico to %APPDATA%\icqm\icq\smiles\statuses\jabber\jabber_odkl_gray.ico.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\html\en\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\en\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\63_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\63_xp.ico.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\joy.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\joy.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\listening to music.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\listening to music.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\rosy.swf to %APPDATA%\icqm\icq\smiles\flash\rosy.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\60.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\60.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\scratch_one-s_head.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\scratch_one-s_head.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\information.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\information.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\61.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\61.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\24a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\24a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissing.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissing.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\61_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\61_xp.ico.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\html\cz\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\cz\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\62.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\62.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\live.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\live.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\shok.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\shok.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\62_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\62_xp.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing out loud (lol).gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing out loud (lol).gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\ok.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\ok.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\oo.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\oo.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\html\de\loading\progress_agent.gif to %APPDATA%\mail.ru\agent\mra\html\de\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\pig.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\pig.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\25a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\25a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\rabotaet.swf to %APPDATA%\icqm\icq\smiles\flash\rabotaet.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissed.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissed.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\63.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\63.ico.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\gift.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gift.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\crazy.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\crazy.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s010.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s010.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\akitaka.swf to %APPDATA%\icqm\icq\smiles\flash\akitaka.swf.rnsmcat4er
from %APPDATA%\opera software\opera stable\extension state\log to %APPDATA%\opera software\opera stable\extension state\log.rnsmcat4er
from %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt to %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt.rnsmcat4er
from %APPDATA%\opera software\opera stable\origin bound certs to %APPDATA%\opera software\opera stable\origin bound certs.rnsmcat4er
from %APPDATA%\opera software\opera stable\origin bound certs-journal to %APPDATA%\opera software\opera stable\origin bound certs-journal.rnsmcat4er
from %APPDATA%\opera software\opera stable\preferences to %APPDATA%\opera software\opera stable\preferences.rnsmcat4er
from %APPDATA%\opera software\opera stable\quotamanager to %APPDATA%\opera software\opera stable\quotamanager.rnsmcat4er
from %APPDATA%\opera software\opera stable\extension state\log.old to %APPDATA%\opera software\opera stable\extension state\log.old.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\angel.swf to %APPDATA%\icqm\icq\smiles\flash\angel.swf.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\fonts\segoesc.ttf to %APPDATA%\mail.ru\agent\mra\fonts\segoesc.ttf.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\dll\altergeo.msi to %APPDATA%\mail.ru\agent\mra\dll\altergeo.msi.rnsmcat4er
from %APPDATA%\microsoft\internet explorer\quick launch\mail.ru agent.lnk to %APPDATA%\microsoft\internet explorer\quick launch\mail.ru agent.lnk.rnsmcat4er
from %APPDATA%\opera software\opera stable\extension state\manifest-000001 to %APPDATA%\opera software\opera stable\extension state\manifest-000001.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\sounds\auth.wav to %APPDATA%\mail.ru\agent\mra\sounds\auth.wav.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\video\video.swf to %APPDATA%\mail.ru\agent\mra\video\video.swf.rnsmcat4er
from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\83aa4cc77f591dfc2374580bbd95f6ba_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\83aa4cc77f591dfc2374580bbd95f6ba_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.rnsmcat4er
from %APPDATA%\microsoft\document building blocks\1033\14\built-in building blocks.dotx to %APPDATA%\microsoft\document building blocks\1033\14\built-in building blocks.dotx.rnsmcat4er
from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f58155b4b1d5a524ca0261c3ee99fb50_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f58155b4b1d5a524ca0261c3ee99fb50_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.rnsmcat4er
from %APPDATA%\opera software\opera stable\extension state\current to %APPDATA%\opera software\opera stable\extension state\current.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\sounds\busy.wav to %APPDATA%\mail.ru\agent\mra\sounds\busy.wav.rnsmcat4er
from %APPDATA%\opera software\opera stable\opera_autoupdate.log to %APPDATA%\opera software\opera stable\opera_autoupdate.log.rnsmcat4er
from %APPDATA%\opera software\opera stable\extension state\000006.ldb to %APPDATA%\opera software\opera stable\extension state\000006.ldb.rnsmcat4er
from %APPDATA%\icqm\icq\sounds\ring.mp3 to %APPDATA%\icqm\icq\sounds\ring.mp3.rnsmcat4er
from %APPDATA%\icqm\icq\sounds\start.wav to %APPDATA%\icqm\icq\sounds\start.wav.rnsmcat4er
from %APPDATA%\icqm\icq\sounds\test_sound.wav to %APPDATA%\icqm\icq\sounds\test_sound.wav.rnsmcat4er
from %APPDATA%\icqm\icq\sounds\voiceend.wav to %APPDATA%\icqm\icq\sounds\voiceend.wav.rnsmcat4er
from %APPDATA%\microsoft\office\recent\xml_excel.lnk to %APPDATA%\microsoft\office\recent\xml_excel.lnk.rnsmcat4er
from %APPDATA%\microsoft\office\recent\xml_excel_wiki.lnk to %APPDATA%\microsoft\office\recent\xml_excel_wiki.lnk.rnsmcat4er
from %APPDATA%\microsoft\office\recent\_copy_license_ja.lnk to %APPDATA%\microsoft\office\recent\_copy_license_ja.lnk.rnsmcat4er
from %APPDATA%\adobe\acrobat\dc\security\addressbook.acrodata to %APPDATA%\adobe\acrobat\dc\security\addressbook.acrodata.rnsmcat4er
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\2365fd05-48cb-42f9-a388-5fd82ffd2512 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\2365fd05-48cb-42f9-a388-5fd82ffd2512.rnsmcat4er
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\24a81978-4594-42c5-80e9-bcd9abebab41 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\24a81978-4594-42c5-80e9-bcd9abebab41.rnsmcat4er
from %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\map0 to %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\map0.rnsmcat4er
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\5fea2324-401c-4a67-adf5-81a4571f8b7d to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\5fea2324-401c-4a67-adf5-81a4571f8b7d.rnsmcat4er
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\857f1812-3b8b-41fd-99c5-09d06e6d1983 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\857f1812-3b8b-41fd-99c5-09d06e6d1983.rnsmcat4er
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\9a5de8c5-f1f1-4a14-bd2a-9a24fc199001 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\9a5de8c5-f1f1-4a14-bd2a-9a24fc199001.rnsmcat4er
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\ae597e89-6b58-4713-b543-846c970a2b49 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\ae597e89-6b58-4713-b543-846c970a2b49.rnsmcat4er
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\b9ed44f4-c00d-45f3-9d18-c556a9a58c43 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\b9ed44f4-c00d-45f3-9d18-c556a9a58c43.rnsmcat4er
from %APPDATA%\opera software\opera stable\extension state\000003.ldb to %APPDATA%\opera software\opera stable\extension state\000003.ldb.rnsmcat4er
from %APPDATA%\opera software\opera stable\login data-journal to %APPDATA%\opera software\opera stable\login data-journal.rnsmcat4er
from %APPDATA%\opera software\opera stable\databases\databases.db-journal to %APPDATA%\opera software\opera stable\databases\databases.db-journal.rnsmcat4er
from %APPDATA%\opera software\opera stable\extension state\000007.log to %APPDATA%\opera software\opera stable\extension state\000007.log.rnsmcat4er
from %APPDATA%\icqm\icq\sounds\otprav.wav to %APPDATA%\icqm\icq\sounds\otprav.wav.rnsmcat4er
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\d8ae0dbf-027a-4aa0-b5b7-f670a7266fd2 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\d8ae0dbf-027a-4aa0-b5b7-f670a7266fd2.rnsmcat4er
from %APPDATA%\icqm\icq\sounds\otprav.mp3 to %APPDATA%\icqm\icq\sounds\otprav.mp3.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\s008.gif.rnsmcat4er
from %APPDATA%\opera software\opera stable\jump list iconsold\3651.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3651.tmp.rnsmcat4er
from %APPDATA%\opera software\opera stable\jump list iconsold\36a1.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\36a1.tmp.rnsmcat4er
from %APPDATA%\opera software\opera stable\jump list iconsold\36c3.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\36c3.tmp.rnsmcat4er
from %APPDATA%\opera software\opera stable\jump list iconsold\3703.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3703.tmp.rnsmcat4er
from %APPDATA%\opera software\opera stable\jump list iconsold\3724.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3724.tmp.rnsmcat4er
from %APPDATA%\opera software\opera stable\jump list iconsold\3765.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3765.tmp.rnsmcat4er
from %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage to %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage.rnsmcat4er
from %APPDATA%\opera software\opera stable\jump list iconsold\3796.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3796.tmp.rnsmcat4er
from %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage-journal.rnsmcat4er
from %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage to %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage.rnsmcat4er
from %APPDATA%\opera software\opera stable\quotamanager-journal to %APPDATA%\opera software\opera stable\quotamanager-journal.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\compatibility.ini.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\database\citylist_en.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_en.csv.rnsmcat4er
from %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage-journal.rnsmcat4er
from %APPDATA%\microsoft\internet explorer\quick launch\mozilla thunderbird.lnk to %APPDATA%\microsoft\internet explorer\quick launch\mozilla thunderbird.lnk.rnsmcat4er
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\d524265f-dddf-4bb6-9b50-623f924971ba to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\d524265f-dddf-4bb6-9b50-623f924971ba.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\database\citylist_kz.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_kz.csv.rnsmcat4er
from %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage to %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage.rnsmcat4er
from %APPDATA%\opera software\opera stable\jump list icons\529f.tmp to %APPDATA%\opera software\opera stable\jump list icons\529f.tmp.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\sounds\call_waiting.wav to %APPDATA%\mail.ru\agent\mra\sounds\call_waiting.wav.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\sounds\call_in.wav to %APPDATA%\mail.ru\agent\mra\sounds\call_in.wav.rnsmcat4er
from %APPDATA%\winamp\plugins\milkdrop2\milk2_msg.ini to %APPDATA%\winamp\plugins\milkdrop2\milk2_msg.ini.rnsmcat4er
from %APPDATA%\opera software\opera stable\jump list icons\50ed.tmp to %APPDATA%\opera software\opera stable\jump list icons\50ed.tmp.rnsmcat4er
from %APPDATA%\opera software\opera stable\jump list icons\514d.tmp to %APPDATA%\opera software\opera stable\jump list icons\514d.tmp.rnsmcat4er
from %APPDATA%\opera software\opera stable\jump list icons\516e.tmp to %APPDATA%\opera software\opera stable\jump list icons\516e.tmp.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\sounds\conference.wav to %APPDATA%\mail.ru\agent\mra\sounds\conference.wav.rnsmcat4er
from %APPDATA%\opera software\opera stable\jump list icons\51ce.tmp to %APPDATA%\opera software\opera stable\jump list icons\51ce.tmp.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\sounds\error.wav to %APPDATA%\mail.ru\agent\mra\sounds\error.wav.rnsmcat4er
from %APPDATA%\opera software\opera stable\jump list icons\51ff.tmp to %APPDATA%\opera software\opera stable\jump list icons\51ff.tmp.rnsmcat4er
from %APPDATA%\opera software\opera stable\jump list icons\524f.tmp to %APPDATA%\opera software\opera stable\jump list icons\524f.tmp.rnsmcat4er
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\bd5b067d-34b5-40ef-9a93-eff9fd1771a3 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\bd5b067d-34b5-40ef-9a93-eff9fd1771a3.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\sounds\letter.wav to %APPDATA%\mail.ru\agent\mra\sounds\letter.wav.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\sounds\message.wav to %APPDATA%\mail.ru\agent\mra\sounds\message.wav.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\sounds\no_answer.wav to %APPDATA%\mail.ru\agent\mra\sounds\no_answer.wav.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\sounds\otprav.wav to %APPDATA%\mail.ru\agent\mra\sounds\otprav.wav.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\sounds\ring.wav to %APPDATA%\mail.ru\agent\mra\sounds\ring.wav.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\sounds\start.wav to %APPDATA%\mail.ru\agent\mra\sounds\start.wav.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\sounds\test_sound.wav to %APPDATA%\mail.ru\agent\mra\sounds\test_sound.wav.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\sounds\voiceend.wav to %APPDATA%\mail.ru\agent\mra\sounds\voiceend.wav.rnsmcat4er
from %APPDATA%\winamp\plugins\milkdrop2\milk2_img.ini to %APPDATA%\winamp\plugins\milkdrop2\milk2_img.ini.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\skin.txt to %APPDATA%\mail.ru\agent\mra\smiles\skin.txt.rnsmcat4er
from %APPDATA%\winamp\plugins\ml\ml_online.ini to %APPDATA%\winamp\plugins\ml\ml_online.ini.rnsmcat4er
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\blist.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\blist.sqlite.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\addons.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\addons.json.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\skin.txt to %APPDATA%\icqm\icq\smiles\skin.txt.rnsmcat4er
from %APPDATA%\microsoft\internet explorer\quick launch\icq.lnk to %APPDATA%\microsoft\internet explorer\quick launch\icq.lnk.rnsmcat4er
from %APPDATA%\icq-profile\update\languages.dict to %APPDATA%\icq-profile\update\languages.dict.rnsmcat4er
from %APPDATA%\telegram desktop\tdata\90ef50e22e92cb8c0 to %APPDATA%\telegram desktop\tdata\90ef50e22e92cb8c0.rnsmcat4er
from %APPDATA%\icq-profile\update\languages.hash to %APPDATA%\icq-profile\update\languages.hash.rnsmcat4er
from %APPDATA%\microsoft\uproof\excludedictionaryen0409.lex to %APPDATA%\microsoft\uproof\excludedictionaryen0409.lex.rnsmcat4er
from %APPDATA%\microsoft\uproof\excludedictionaryen0809.lex to %APPDATA%\microsoft\uproof\excludedictionaryen0809.lex.rnsmcat4er
from %APPDATA%\icq-profile\update\ver.txt to %APPDATA%\icq-profile\update\ver.txt.rnsmcat4er
from %APPDATA%\mirc\scripts\aliases.ini to %APPDATA%\mirc\scripts\aliases.ini.rnsmcat4er
from %APPDATA%\microsoft\templates\normal.dotm to %APPDATA%\microsoft\templates\normal.dotm.rnsmcat4er
from %APPDATA%\mra\update\languages.aff to %APPDATA%\mra\update\languages.aff.rnsmcat4er
from %APPDATA%\opera software\opera stable\bookmarks.bak to %APPDATA%\opera software\opera stable\bookmarks.bak.rnsmcat4er
from %APPDATA%\mirc\scripts\popups.ini to %APPDATA%\mirc\scripts\popups.ini.rnsmcat4er
from %APPDATA%\opera software\opera stable\bookmarksextras to %APPDATA%\opera software\opera stable\bookmarksextras.rnsmcat4er
from %APPDATA%\adobe\acrobat\dc\tmdocs.sav to %APPDATA%\adobe\acrobat\dc\tmdocs.sav.rnsmcat4er
from %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c1 to %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c1.rnsmcat4er
from %APPDATA%\telegram desktop\tdata\prefix to %APPDATA%\telegram desktop\tdata\prefix.rnsmcat4er
from %APPDATA%\telegram desktop\tdata\settings0 to %APPDATA%\telegram desktop\tdata\settings0.rnsmcat4er
from %APPDATA%\mra\update\languages.dict to %APPDATA%\mra\update\languages.dict.rnsmcat4er
from %APPDATA%\adobe\acrobat\dc\tmgrpprm.sav to %APPDATA%\adobe\acrobat\dc\tmgrpprm.sav.rnsmcat4er
from %APPDATA%\thunderbird\crash reports\installtime20150330093429 to %APPDATA%\thunderbird\crash reports\installtime20150330093429.rnsmcat4er
from %APPDATA%\opera software\opera stable\browser.js to %APPDATA%\opera software\opera stable\browser.js.rnsmcat4er
from %APPDATA%\mra\base\opt.dbs to %APPDATA%\mra\base\opt.dbs.rnsmcat4er
from %APPDATA%\mra\base\mra.dbs to %APPDATA%\mra\base\mra.dbs.rnsmcat4er
from %ALLUSERSPROFILE%\xi\lqxfet.sre to %ALLUSERSPROFILE%\xi\lqxfet.sre.rnsmcat4er
from %APPDATA%\ghisler\wincmd.ini to %APPDATA%\ghisler\wincmd.ini.rnsmcat4er
from %APPDATA%\mirc\mirc.ini to %APPDATA%\mirc\mirc.ini.rnsmcat4er
from %APPDATA%\mirc\servers.ini to %APPDATA%\mirc\servers.ini.rnsmcat4er
from %APPDATA%\mirc\urls.ini to %APPDATA%\mirc\urls.ini.rnsmcat4er
from %APPDATA%\qipguard\cache to %APPDATA%\qipguard\cache.rnsmcat4er
from %APPDATA%\telegram desktop\log.txt to %APPDATA%\telegram desktop\log.txt.rnsmcat4er
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.rnsmcat4er
from %APPDATA%\winamp\demo.mp3 to %APPDATA%\winamp\demo.mp3.rnsmcat4er
from %APPDATA%\adobe\logtransport2\logtransport2.cfg to %APPDATA%\adobe\logtransport2\logtransport2.cfg.rnsmcat4er
from %APPDATA%\icq-profile\base\mra.dbs to %APPDATA%\icq-profile\base\mra.dbs.rnsmcat4er
from %APPDATA%\microsoft\mmc\taskschd to %APPDATA%\microsoft\mmc\taskschd.rnsmcat4er
from %APPDATA%\icq-profile\base\opt.dbs to %APPDATA%\icq-profile\base\opt.dbs.rnsmcat4er
from %APPDATA%\winamp\winamp.ini to %APPDATA%\winamp\winamp.ini.rnsmcat4er
from %APPDATA%\winamp\winamp.m3u8 to %APPDATA%\winamp\winamp.m3u8.rnsmcat4er
from %APPDATA%\microsoft\uproof\custom.dic to %APPDATA%\microsoft\uproof\custom.dic.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.rnsmcat4er
from %APPDATA%\microsoft\office\mso1033.acl to %APPDATA%\microsoft\office\mso1033.acl.rnsmcat4er
from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist.rnsmcat4er
from %APPDATA%\icq-profile\update\languages.aff to %APPDATA%\icq-profile\update\languages.aff.rnsmcat4er
from %APPDATA%\icqm\icq\sounds\no_answer.wav to %APPDATA%\icqm\icq\sounds\no_answer.wav.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\database\citylist_ru.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_ru.csv.rnsmcat4er
from %APPDATA%\opera software\opera stable\bookmarks to %APPDATA%\opera software\opera stable\bookmarks.rnsmcat4er
from %APPDATA%\icqm\icq\database\citylist_uz.csv to %APPDATA%\icqm\icq\database\citylist_uz.csv.rnsmcat4er
from %APPDATA%\icqm\icq\sounds\busy.mp3 to %APPDATA%\icqm\icq\sounds\busy.mp3.rnsmcat4er
from %APPDATA%\opera software\opera stable\local state to %APPDATA%\opera software\opera stable\local state.rnsmcat4er
from %APPDATA%\opera software\opera stable\login data to %APPDATA%\opera software\opera stable\login data.rnsmcat4er
from %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk to %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk.rnsmcat4er
from %APPDATA%\icqm\icq\sounds\call_in.wav to %APPDATA%\icqm\icq\sounds\call_in.wav.rnsmcat4er
from %APPDATA%\icqm\icq\sounds\conference.mp3 to %APPDATA%\icqm\icq\sounds\conference.mp3.rnsmcat4er
from %APPDATA%\icqm\icq\sounds\error.wav to %APPDATA%\icqm\icq\sounds\error.wav.rnsmcat4er
from %APPDATA%\mozilla\firefox\crash reports\installtime20150415140819 to %APPDATA%\mozilla\firefox\crash reports\installtime20150415140819.rnsmcat4er
from %APPDATA%\microsoft\office\recent\clarify.lnk to %APPDATA%\microsoft\office\recent\clarify.lnk.rnsmcat4er
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\abook.mab to %APPDATA%\thunderbird\profiles\wjj9aet2.default\abook.mab.rnsmcat4er
from %APPDATA%\microsoft\office\recent\license_en.lnk to %APPDATA%\microsoft\office\recent\license_en.lnk.rnsmcat4er
from %APPDATA%\icqm\icq\sounds\letter.wav to %APPDATA%\icqm\icq\sounds\letter.wav.rnsmcat4er
from %APPDATA%\microsoft\office\recent\license_ja.lnk to %APPDATA%\microsoft\office\recent\license_ja.lnk.rnsmcat4er
from %APPDATA%\microsoft\office\recent\protect.lnk to %APPDATA%\microsoft\office\recent\protect.lnk.rnsmcat4er
from %APPDATA%\microsoft\office\recent\templates.lnk to %APPDATA%\microsoft\office\recent\templates.lnk.rnsmcat4er
from %APPDATA%\microsoft\office\recent\virtual-machiene-introspection.lnk to %APPDATA%\microsoft\office\recent\virtual-machiene-introspection.lnk.rnsmcat4er
from %APPDATA%\microsoft\office\recent\vm introspection.lnk to %APPDATA%\microsoft\office\recent\vm introspection.lnk.rnsmcat4er
from %APPDATA%\icqm\icq\sounds\message.mp3 to %APPDATA%\icqm\icq\sounds\message.mp3.rnsmcat4er
from %APPDATA%\icqm\icq\video\video.swf to %APPDATA%\icqm\icq\video\video.swf.rnsmcat4er
from %APPDATA%\opera software\opera stable\certificate revocation lists to %APPDATA%\opera software\opera stable\certificate revocation lists.rnsmcat4er
from %APPDATA%\telegram desktop\tdata\shortcuts-custom.json to %APPDATA%\telegram desktop\tdata\shortcuts-custom.json.rnsmcat4er
from %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini to %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini.rnsmcat4er
from %APPDATA%\mra\update\languages.hash to %APPDATA%\mra\update\languages.hash.rnsmcat4er
from %APPDATA%\mra\update\ver.txt to %APPDATA%\mra\update\ver.txt.rnsmcat4er
from %APPDATA%\opera software\opera stable\cookies-journal to %APPDATA%\opera software\opera stable\cookies-journal.rnsmcat4er
from %APPDATA%\telegram desktop\tdata\shortcuts-default.json to %APPDATA%\telegram desktop\tdata\shortcuts-default.json.rnsmcat4er
from %APPDATA%\opera software\opera stable\favicons to %APPDATA%\opera software\opera stable\favicons.rnsmcat4er
from %APPDATA%\telegram desktop\tdata\usertag to %APPDATA%\telegram desktop\tdata\usertag.rnsmcat4er
from %APPDATA%\opera software\opera stable\favicons-journal to %APPDATA%\opera software\opera stable\favicons-journal.rnsmcat4er
from %APPDATA%\icqm\icq\database\citylist_en.csv to %APPDATA%\icqm\icq\database\citylist_en.csv.rnsmcat4er
from %APPDATA%\icqm\icq\dll\altergeo.msi to %APPDATA%\icqm\icq\dll\altergeo.msi.rnsmcat4er
from %APPDATA%\icqm\icq\database\citylist_kz.csv to %APPDATA%\icqm\icq\database\citylist_kz.csv.rnsmcat4er
from %APPDATA%\icqm\icq\database\citylist_ru.csv to %APPDATA%\icqm\icq\database\citylist_ru.csv.rnsmcat4er
from %APPDATA%\icqm\icq\fonts\segoesc.ttf to %APPDATA%\icqm\icq\fonts\segoesc.ttf.rnsmcat4er
from %APPDATA%\opera software\opera stable\favorites.db-journal to %APPDATA%\opera software\opera stable\favorites.db-journal.rnsmcat4er
from %APPDATA%\opera software\opera stable\history to %APPDATA%\opera software\opera stable\history.rnsmcat4er
from %APPDATA%\icqm\icq\database\citylist_tr.csv to %APPDATA%\icqm\icq\database\citylist_tr.csv.rnsmcat4er
from %APPDATA%\icqm\icq\database\citylist_ua.csv to %APPDATA%\icqm\icq\database\citylist_ua.csv.rnsmcat4er
from %APPDATA%\opera software\opera stable\history provider cache to %APPDATA%\opera software\opera stable\history provider cache.rnsmcat4er
from %APPDATA%\icqm\icq\sounds\auth.mp3 to %APPDATA%\icqm\icq\sounds\auth.mp3.rnsmcat4er
from %APPDATA%\opera software\opera stable\history-journal to %APPDATA%\opera software\opera stable\history-journal.rnsmcat4er
from %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk.rnsmcat4er
from %APPDATA%\opera software\opera stable\cookies to %APPDATA%\opera software\opera stable\cookies.rnsmcat4er
from %APPDATA%\opera software\opera stable\extension state\lock to %APPDATA%\opera software\opera stable\extension state\lock.rnsmcat4er
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\f8401b27-0c7a-4d0f-80a5-9679c6328419 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\f8401b27-0c7a-4d0f-80a5-9679c6328419.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set04\s003.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s003.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set06\s002.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s002.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\can't say-shut up.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\can't say-shut up.gif.rnsmcat4er
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\places.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\places.sqlite.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\dance.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\dance.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set04\s004.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s004.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\06a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\06a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\aaa.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\aaa.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\blum1.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\blum1.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s003.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s003.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\beer.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\beer.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set06\s003.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s003.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set04\s005.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s005.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\07a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\07a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\devil.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\devil.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\biggrin.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\biggrin.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\cool.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\cool.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\8march\love.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\love.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\kisses.swf to %APPDATA%\icqm\icq\smiles\flash\kisses.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\bad.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\bad.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_mouse.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_mouse.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\joy.swf to %APPDATA%\icqm\icq\smiles\flash\joy.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set04\s001.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s001.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\02.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\02.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blushing.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blushing.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\03a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\03a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\book.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\book.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\angel.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\angel.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\bad.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\bad.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_paper.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_paper.gif.rnsmcat4er
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\parent.lock to %APPDATA%\thunderbird\profiles\wjj9aet2.default\parent.lock.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\bomb.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\bomb.gif.rnsmcat4er
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\permissions.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\permissions.sqlite.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set04\s002.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s002.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s002.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s002.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\04b.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\04b.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\biggrin.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\biggrin.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set06\s001.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s001.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\beback.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\beback.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blinking.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blinking.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\could.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\could.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set06\s004.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s004.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\eat.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\eat.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\11a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\11a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\blush.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\blush.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\bazilio.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\bazilio.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf to %APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\fingal.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\fingal.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s008.gif.rnsmcat4er
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\session.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\session.json.rnsmcat4er
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\sessioncheckpoints.json.rnsmcat4er
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\times.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\times.json.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\flowr.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\flowr.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\gg.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gg.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\cray.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\cray.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\gg2.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gg2.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s009.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s009.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\devil.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\devil.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set04\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s008.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s007.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s007.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\10a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\10a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\blush.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\blush.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s004.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s004.gif.rnsmcat4er
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\prefs.js to %APPDATA%\thunderbird\profiles\wjj9aet2.default\prefs.js.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\kot_cool.swf to %APPDATA%\icqm\icq\smiles\flash\kot_cool.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\08a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\08a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set03\blum.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\blum.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\fight.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\fight.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\crying.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\crying.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\bomb.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\bomb.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\amazed.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\amazed.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s005.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s005.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set04\s007.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s007.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\angry.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\angry.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\bodun.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\bodun.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set06\s006.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s006.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\09a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\09a.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\smiles\ass.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\ass.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf to %APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set04\s006.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s006.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s006.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s006.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\set05\s001.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s001.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf to %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\drako_love.swf to %APPDATA%\icqm\icq\smiles\flash\drako_love.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf to %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf.rnsmcat4er
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite.rnsmcat4er
from %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\opera software\opera stable\session.dbak to %APPDATA%\opera software\opera stable\session.dbak.rnsmcat4er
from %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\opera software\opera stable\siteprefs.json to %APPDATA%\opera software\opera stable\siteprefs.json.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf to %APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf.rnsmcat4er
from %APPDATA%\opera software\opera stable\ssdfp1652.1.1724122967 to %APPDATA%\opera software\opera stable\ssdfp1652.1.1724122967.rnsmcat4er
from %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf to %APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf.rnsmcat4er
from %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\opera software\opera stable\ssdfp2216.0.2078311798 to %APPDATA%\opera software\opera stable\ssdfp2216.0.2078311798.rnsmcat4er
from %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\duh.swf to %APPDATA%\icqm\icq\smiles\flash\duh.swf.rnsmcat4er
from %APPDATA%\opera software\opera stable\ssdfp2512.4.1739910927 to %APPDATA%\opera software\opera stable\ssdfp2512.4.1739910927.rnsmcat4er
from %APPDATA%\opera software\opera stable\ssdfp2544.3.670597881 to %APPDATA%\opera software\opera stable\ssdfp2544.3.670597881.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf to %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf.rnsmcat4er
from %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\devochka.swf to %APPDATA%\icqm\icq\smiles\flash\devochka.swf.rnsmcat4er
from %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.ini to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.ini.rnsmcat4er
from %APPDATA%\microsoft\internet explorer\quick launch\qip 2012.lnk to %APPDATA%\microsoft\internet explorer\quick launch\qip 2012.lnk.rnsmcat4er
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\preferred to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\preferred.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\database\citylist_tr.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_tr.csv.rnsmcat4er
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\compatibility.ini to %APPDATA%\thunderbird\profiles\wjj9aet2.default\compatibility.ini.rnsmcat4er
from %APPDATA%\opera software\opera stable\session.db-journal to %APPDATA%\opera software\opera stable\session.db-journal.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.json.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\database\citylist_ua.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_ua.csv.rnsmcat4er
from %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk to %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk.rnsmcat4er
from %APPDATA%\microsoft\internet explorer\quick launch\winamp.lnk to %APPDATA%\microsoft\internet explorer\quick launch\winamp.lnk.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\database\citylist_uz.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_uz.csv.rnsmcat4er
from %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk to %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\beback.swf to %APPDATA%\icqm\icq\smiles\flash\beback.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\beer.swf to %APPDATA%\icqm\icq\smiles\flash\beer.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\bodun.swf to %APPDATA%\icqm\icq\smiles\flash\bodun.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\boo.swf to %APPDATA%\icqm\icq\smiles\flash\boo.swf.rnsmcat4er
from %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage-journal.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\healthreport.sqlite to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\healthreport.sqlite.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\canthearu.swf to %APPDATA%\icqm\icq\smiles\flash\canthearu.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\chillout.swf to %APPDATA%\icqm\icq\smiles\flash\chillout.swf.rnsmcat4er
from %APPDATA%\opera software\opera stable\thumbnails.db-journal to %APPDATA%\opera software\opera stable\thumbnails.db-journal.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf to %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf.rnsmcat4er
from %APPDATA%\opera software\opera stable\transportsecurity to %APPDATA%\opera software\opera stable\transportsecurity.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\xulstore.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\xulstore.json.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\information.swf to %APPDATA%\icqm\icq\smiles\flash\information.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_hand.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_hand.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\akitaka.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\akitaka.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\air_kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\air_kiss.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_lick.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_lick.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\01.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\01.gif.rnsmcat4er
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\foldertree.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\foldertree.json.rnsmcat4er
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\global-messages-db.sqlite.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\angel.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\angel.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\angel.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\angel.swf.rnsmcat4er
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\history.mab to %APPDATA%\thunderbird\profiles\wjj9aet2.default\history.mab.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\bad_cold.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\bad_cold.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_meow.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_meow.gif.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\user.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\user.js.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sitesecurityservicestate.txt.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\times.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\times.json.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessioncheckpoints.json.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\gangsta.swf to %APPDATA%\icqm\icq\smiles\flash\gangsta.swf.rnsmcat4er
from %APPDATA%\opera software\opera stable\visited links to %APPDATA%\opera software\opera stable\visited links.rnsmcat4er
from %APPDATA%\opera software\opera stable\web data to %APPDATA%\opera software\opera stable\web data.rnsmcat4er
from %APPDATA%\opera software\opera stable\web data-journal to %APPDATA%\opera software\opera stable\web data-journal.rnsmcat4er
from %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\kiks.yandex.ru\fuid01.sol to %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\kiks.yandex.ru\fuid01.sol.rnsmcat4er
from %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\microsoft\network\connections\pbk\_hiddenpbk\rasphone.pbk to %APPDATA%\microsoft\network\connections\pbk\_hiddenpbk\rasphone.pbk.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\8march\car.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\car.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\flash\guby.swf to %APPDATA%\icqm\icq\smiles\flash\guby.swf.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\statuses\set01\71_xp.ico to %APPDATA%\icqm\icq\smiles\statuses\set01\71_xp.ico.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\could.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\could.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif.rnsmcat4er
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.ini to %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.ini.rnsmcat4er
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.json.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js.rnsmcat4er
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_attack.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_attack.gif.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\revocations.txt to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\revocations.txt.rnsmcat4er
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\search.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\search.json.rnsmcat4er
from %APPDATA%\opera software\opera stable\update_prefs.json to %APPDATA%\opera software\opera stable\update_prefs.json.rnsmcat4er
from %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif.rnsmcat4er
from %APPDATA%\mail.ru\agent\mra\smiles\flash\laugh.swf to %APPDATA%\mail.ru\agent\mra\smiles\flash\laugh.swf.rnsmcat4er

Modifies the following files

%HOMEPATH%\documents\desktop.ini.rnsmcat4er
%ALLUSERSPROFILE%\mozilla\logs\maintenanceservice-uninstall.log.rnsmcat4er
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi.rnsmcat4er
%ALLUSERSPROFILE%\microsoft help\hx_1033_mvalidator.hxd.rnsmcat4er
%ALLUSERSPROFILE%\microsoft\office\documentrepository.ico.rnsmcat4er
C:\far2\farcze.lng.rnsmcat4er
C:\users\default\ntuser.dat.log1.rnsmcat4er
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1500820082.msp.rnsmcat4er
%ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp.rnsmcat4er
C:\users\desktop.ini.rnsmcat4er
C:\far2\far.map.rnsmcat4er
%ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmp.rnsmcat4er
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.rnsmcat4er
%ALLUSERSPROFILE%\mozilla\logs\maintenanceservice-install.log.rnsmcat4er
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\tokens.dat.rnsmcat4er
%ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico.rnsmcat4er
%ALLUSERSPROFILE%\microsoft help\hx_1033_mtoc_hx.hxh.rnsmcat4er
C:\far2\clearpluginscache.cmd.rnsmcat4er
C:\far2\changelog_eng.rnsmcat4er
C:\users\default\ntuser.dat.log.rnsmcat4er
C:\far2\changelog.rnsmcat4er
%ALLUSERSPROFILE%\microsoft help\hx_1033_mkwd_namedurl.hxw.rnsmcat4er
%ALLUSERSPROFILE%\microsoft help\hx_1033_mkwd_k.hxw.rnsmcat4er
C:\users\default\ntuser.dat.rnsmcat4er
%ALLUSERSPROFILE%\microsoft help\hx.hxn.rnsmcat4er
%ALLUSERSPROFILE%\microsoft toolkit\settings.xml.rnsmcat4er
%ALLUSERSPROFILE%\ntuser.pol.rnsmcat4er
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.rnsmcat4er
%ALLUSERSPROFILE%\microsoft\crypto\keys\68383f0e45dd9b02f69c4041b082ee57_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.rnsmcat4er
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\acrordrdcupd1500920077.msp.rnsmcat4er

Modifies multiple files.

Substitutes the following files

%ALLUSERSPROFILE%\Microsoft\User Account Pictures\user.dat
%APPDATA%\Opera Software\Opera Stable\opera_shutdown_ms.txt
%APPDATA%\Winamp\Plugins\ml\ml_online.ini
%LOCALAPPDATA%\Thunderbird\Profiles\wjj9aet2.default\_CACHE_CLEAN_
%LOCALAPPDATA%\Google\Chrome\User Data\Default\History Provider Cache
%APPDATA%\Microsoft\Network\Connections\Pbk\_hiddenPbk\rasphone.pbk
%APPDATA%\Thunderbird\Profiles\wjj9aet2.default\folderTree.json
%APPDATA%\Thunderbird\Profiles\wjj9aet2.default\parent.lock
%APPDATA%\Thunderbird\Profiles\wjj9aet2.default\virtualFolders.dat
%LOCALAPPDATA%\Microsoft\Internet Explorer\DOMStore\G32IFQHJ\helpx.adobe[1].xml
%LOCALAPPDATA%\Google\Chrome\User Data\Default\TransportSecurity
%LOCALAPPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\_CACHE_CLEAN_
%LOCALAPPDATA%\Google\Chrome\User Data\Default\GCM Store\000003.log
%LOCALAPPDATA%\Google\Chrome\User Data\Default\GCM Store\000004.log
%LOCALAPPDATA%\Google\Chrome\User Data\Default\GCM Store\000005.log
%LOCALAPPDATA%\Google\Chrome\User Data\Default\GCM Store\LOCK
%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extension State\LOCK
%LOCALAPPDATA%\Google\Chrome\User Data\Default\JumpListIcons\B8E2.tmp
%LOCALAPPDATA%\Google\Chrome\User Data\Default\JumpListIconsOld\8A6C.tmp
%LOCALAPPDATA%\Google\Chrome\User Data\Default\JumpListIcons\B8E3.tmp
%LOCALAPPDATA%\Google\Chrome\User Data\Default\JumpListIconsOld\8A6D.tmp
%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\webapps\webapps.json
%APPDATA%\Opera Software\Opera Stable\Extension State\LOCK
%LOCALAPPDATA%\Google\Chrome\User Data\Default\JumpListIcons\B8E4.tmp
%APPDATA%\Adobe\Acrobat\DC\Preferences\AutoFillDefaults.dat
%LOCALAPPDATA%\Google\Chrome\User Data\chrome_shutdown_ms.txt
%ALLUSERSPROFILE%\Microsoft Help\Hx_1033_MValidator.Lck
%ALLUSERSPROFILE%\microsoft help\hx_1033_mvalidator.lck.rnsmcat4er
C:\Users\Default\NTUSER.DAT.LOG2
%ALLUSERSPROFILE%\microsoft\user account pictures\user.dat.rnsmcat4er
%ALLUSERSPROFILE%\Microsoft\RAC\StateData\RacMetaData.dat
%ALLUSERSPROFILE%\Microsoft Help\MS.Dexplore_1033_MValidator.Lck
%ALLUSERSPROFILE%\microsoft help\ms.dexplore_1033_mvalidator.lck.rnsmcat4er
%ALLUSERSPROFILE%\Microsoft Help\MS.NETFrameworkSDKv1.1_1033_MValidator.Lck
%APPDATA%\ICQM\vplog.dat
%ALLUSERSPROFILE%\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.lck.rnsmcat4er
%ALLUSERSPROFILE%\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.Lck
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mvalidator.lck.rnsmcat4er
%APPDATA%\Mail.Ru\Agent\vplog.dat
%APPDATA%\Microsoft\UProof\CUSTOM.DIC
%APPDATA%\Thunderbird\Crash Reports\InstallTime20150330093429
%APPDATA%\Microsoft\UProof\ExcludeDictionaryEN0409.lex
%APPDATA%\Microsoft\UProof\ExcludeDictionaryEN0809.lex
%APPDATA%\ICQ-Profile\Update\vvlog.dat
%APPDATA%\Mra\Update\vvlog.dat
%APPDATA%\Telegram Desktop\tdata\usertag
%APPDATA%\Mozilla\Firefox\Crash Reports\InstallTime20150415140819
%LOCALAPPDATA%\Google\Chrome\User Data\First Run
%LOCALAPPDATA%\Google\Chrome\User Data\Default\JumpListIcons\B8E5.tmp

Changes user data files extensions (Trojan.Encoder).

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial