Trojan.PWS.Siggen2.33858

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%HOMEPATH%\start menu\programs\startup\x.vbs
%HOMEPATH%\start menu\programs\startup\@please_read_me@.txt
%HOMEPATH%\start menu\programs\startup\@wanadecryptor@.exe.lnk
%HOMEPATH%\start menu\programs\startup\x.vbs.wncryt

Creates the following files on removable media

<Drive name for removable media>:\asaprojectcompetition.pptx.wncryt
<Drive name for removable media>:\samieee_obiee_presentation.pptx.wncryt
<Drive name for removable media>:\indogerman2010.pptx.wncryt
<Drive name for removable media>:\middaugh_keynote.pptx.wncryt
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx.wncryt
<Drive name for removable media>:\@please_read_me@.txt
<Drive name for removable media>:\@wanadecryptor@.exe

Malicious functions

Injects code into

the following user processes:

k.abc

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\dial.bmp

Modifies file system

Creates the following files

%TEMP%\ixp000.tmp\k.abc
%APPDATA%\icqm\icq\smiles\smiles\set06\s010.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set06\s011.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set06\s012.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set06\s013.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set06\s014.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set06\s008.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set06\s009.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set06\s015.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set06\s018.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set06\s019.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set06\s020.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\angry.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\ass.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set06\s016.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set06\s017.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\bee.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\bazilio.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set06\s003.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s011.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s012.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s013.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s014.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set06\s004.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s009.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set06\s006.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s015.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s019.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s020.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set06\s001.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set06\s002.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s016.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s017.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s018.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\mocking.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\blink.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\valentine\jealousy.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\valentine\kissed.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\valentine\lets_play.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\valentine\on_wings.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\valentine\undress.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\valentine\in_love.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\valentine\want_you.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\valentine\kiss.gif.wncryt
%APPDATA%\icqm\icq\sounds\busy.mp3.wncryt
%APPDATA%\icqm\icq\sounds\conference.mp3.wncryt
%APPDATA%\icqm\icq\sounds\error.wav.wncryt
%APPDATA%\icqm\icq\sounds\letter.wav.wncryt
%APPDATA%\icqm\icq\sounds\message.mp3.wncryt
%APPDATA%\icqm\icq\sounds\auth.mp3.wncryt
%APPDATA%\icqm\icq\smiles\smiles\valentine\dont_be_late.gif.wncryt
%APPDATA%\icqm\icq\sounds\call_in.wav.wncryt
%APPDATA%\icqm\icq\smiles\smiles\valentine\broken_heart.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\zloradstvo.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\coolguy.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\disappointed.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\heart.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\hm.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\kiss.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\laughter.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\oo.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\cry.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\pig.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\rrr.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\sceptic.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\shy.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\smile.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\vampire.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s008.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\really.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s010.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s007.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s006.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s005.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\bad.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\blum.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\blush.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\cray.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\52a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\50a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\angel.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\crazy.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\drinks.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\facepalm.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\fool.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\good.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\dance.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\diablo.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\dirol.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\51a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\49a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\kiss_mini.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\08a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\09a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\10a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\11a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\13a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\14a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\07a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\26a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\28a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\41b.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\44a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\45a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\47a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\48a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\27a.gif.wncryt
%APPDATA%\icqm\icq\sounds\no_answer.wav.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\bullshit.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\man_in_love.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\pardon.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set04\s009.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set04\s010.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set04\s011.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set04\s012.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set04\s006.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set04\s013.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set04\s008.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set04\s015.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s001.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s002.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s003.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set05\s004.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set04\s014.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\53a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set04\s016.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set04\s007.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set04\s005.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set04\s004.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\rofl.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\rolleyes.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\sad.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\scratch_one-s_head.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\shok.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\nea.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\shout.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\unknw.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\wacko2.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\wink.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\yahoo.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set04\s001.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set04\s002.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\smile.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set04\s003.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\music.gif.wncryt
<LS_APPDATA>\google\chrome\user data\default\bookmarks.bak.wncryt
%HOMEPATH%\templates\sndrec.wav.wncryt
%APPDATA%\icqm\icq\sounds\ring.mp3.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\live.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\ok.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\plug.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\sleepy.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\tears.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\koza_right.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\kukes.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\think.gif.wncryt
%APPDATA%\mozilla\firefox\profiles\22ie2h77.default\sitesecurityservicestate.txt.wncryt
%APPDATA%\mozilla\firefox\profiles\22ie2h77.default\sessionstore-backups\previous.js.wncryt
%APPDATA%\mozilla\firefox\profiles\22ie2h77.default\sessionstore-backups\recovery.js.wncryt
%APPDATA%\opera software\opera stable\opera_shutdown_ms.txt.wncryt
%HOMEPATH%\cookies\user@326944[1].txt.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\victory.gif.wncryt
%APPDATA%\microsoft\internet explorer\brndlog.bak.wncryt
%HOMEPATH%\cookies\user@adnxs[1].txt.wncryt
%HOMEPATH%\cookies\user@7ba[1].txt.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\fist.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\43a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\46a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\biggrin.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\set03\give_rose.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\fuck.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\40a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\koza_left.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\aaa.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\crocodile.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\detzl.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\devil.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\die.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\amazed.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\biganger.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\smiles\biggrin.gif.wncryt
%APPDATA%\icqm\icq\sounds\otprav.mp3.wncryt
%HOMEPATH%\cookies\user@adobe[1].txt.wncryt
%HOMEPATH%\cookies\user@softkey[2].txt.wncryt
%HOMEPATH%\cookies\user@winrar.softkey[2].txt.wncryt
%HOMEPATH%\cookies\user@www.msn[1].txt.wncryt
%HOMEPATH%\cookies\user@yadro[1].txt.wncryt
%HOMEPATH%\cookies\user@yandex[2].txt.wncryt
%HOMEPATH%\cookies\user@serving-sys[2].txt.wncryt
<LS_APPDATA>\chromium\user data\default\bookmarks_20150820130020.backup.wncryt
%HOMEPATH%\cookies\user@win-rar[1].txt.wncryt
<LS_APPDATA>\google\chrome\user data\chrome_shutdown_ms.txt.wncryt
<LS_APPDATA>\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\main.js.wncryt
<LS_APPDATA>\google\chrome\user data\default\service worker\cachestorage\b5828dd7cc3b943f8890a5bb6e3b1b63e8ee8703\index.txt.wncryt
<LS_APPDATA>\nichrome\user data\default\bookmarks_20150820130020.backup.wncryt
<LS_APPDATA>\nichrome\user data\default\preferences_20150820130020.backup.wncryt
<LS_APPDATA>\chromium\user data\default\preferences_20150820130020.backup.wncryt
%HOMEPATH%\cookies\user@scorecardresearch[2].txt.wncryt
<LS_APPDATA>\google\chrome\user data\default\bookmarks_20150820130020.backup.wncryt
%HOMEPATH%\cookies\user@rarlab[1].txt.wncryt
%HOMEPATH%\cookies\user@rambler[2].txt.wncryt
%HOMEPATH%\cookies\user@bing[1].txt.wncryt
%HOMEPATH%\cookies\user@c.bing[1].txt.wncryt
%HOMEPATH%\cookies\user@c.msn[1].txt.wncryt
%HOMEPATH%\cookies\user@d.castplatform[2].txt.wncryt
%HOMEPATH%\cookies\user@help.softkey[2].txt.wncryt
%HOMEPATH%\cookies\user@help.softkey[3].txt.wncryt
%HOMEPATH%\cookies\user@mail[1].txt.wncryt
%HOMEPATH%\cookies\user@bluekai[2].txt.wncryt
%HOMEPATH%\cookies\user@microsoft[1].txt.wncryt
%HOMEPATH%\cookies\user@msn[1].txt.wncryt
%HOMEPATH%\cookies\user@openstat[1].txt.wncryt
%HOMEPATH%\cookies\user@opera[1].txt.wncryt
%HOMEPATH%\cookies\user@point4all[2].txt.wncryt
%HOMEPATH%\cookies\user@rabotaetvse[1].txt.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\39a.gif.wncryt
%HOMEPATH%\cookies\user@mon.softkey[2].txt.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\42a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\38a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\37.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\36a.gif.wncryt
%APPDATA%\opera software\opera stable\bookmarks_20150820130023.backup.wncryt
%APPDATA%\opera software\opera stable\browser.js.wncryt
%APPDATA%\opera software\opera stable\favorites.db.wncryt
%APPDATA%\opera software\opera stable\preferences_20150820125838.backup.wncryt
%APPDATA%\opera software\opera stable\bookmarks_20150820130020.backup.wncryt
%APPDATA%\opera software\opera stable\bookmarks_20150820125840.backup.wncryt
%APPDATA%\opera software\opera stable\bookmarks_20150820130022.backup.wncryt
%APPDATA%\opera software\opera stable\preferences_20150820130020.backup.wncryt
%APPDATA%\thunderbird\profiles\cr5sc40q.default\cert8.db.wncryt
%APPDATA%\thunderbird\profiles\cr5sc40q.default\key3.db.wncryt
%APPDATA%\thunderbird\profiles\cr5sc40q.default\prefs.js.wncryt
%APPDATA%\thunderbird\profiles\cr5sc40q.default\secmod.db.wncryt
%APPDATA%\opera software\opera stable\thumbnails.db.wncryt
%APPDATA%\opera software\opera stable\web data_20150820125838.backup.wncryt
%APPDATA%\opera software\opera stable\web data_20150820130020.backup.wncryt
%APPDATA%\opera software\opera stable\bookmarks_20150820125841.backup.wncryt
%APPDATA%\opera software\opera stable\bookmarks_20150820125839.backup.wncryt
<LS_APPDATA>\iconcache.db.wncryt
%APPDATA%\icqm\icq\sounds\test_sound.wav.wncryt
%APPDATA%\icqm\icq\sounds\voiceend.wav.wncryt
%APPDATA%\icqm\icq\video\video.swf.wncryt
%APPDATA%\microsoft\document building blocks\1033\building blocks.dotx.wncryt
%APPDATA%\microsoft\templates\normal.dotm.wncryt
%APPDATA%\mozilla\firefox\profiles\22ie2h77.default\cert8.db.wncryt
%APPDATA%\icqm\icq\sounds\start.wav.wncryt
%APPDATA%\mozilla\firefox\profiles\22ie2h77.default\key3.db.wncryt
%APPDATA%\mozilla\firefox\profiles\22ie2h77.default\prefs.js_20150820125841.backup.wncryt
%APPDATA%\mozilla\firefox\profiles\22ie2h77.default\prefs.js_20150820130023.backup.wncryt
%APPDATA%\mozilla\firefox\profiles\22ie2h77.default\secmod.db.wncryt
%APPDATA%\mozilla\firefox\profiles\22ie2h77.default\user.js.wncryt
%APPDATA%\opera software\opera stable\bookmarks.bak.wncryt
%APPDATA%\opera software\opera stable\bookmarks_20150820125838.backup.wncryt
%APPDATA%\mozilla\firefox\profiles\22ie2h77.default\prefs.js.wncryt
%APPDATA%\icqm\icq\sounds\otprav.wav.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\06a.gif.wncryt
<LS_APPDATA>\chromium\user data\default\web data_20150820130020.backup.wncryt
<LS_APPDATA>\google\chrome\user data\default\databases\databases.db.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\20a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\21a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\22a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\23a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\16a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\24a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\19a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\29a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\31a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\32a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\33a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\34a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\25a.gif.wncryt
%APPDATA%\opera software\opera stable\bookmarks_20150820130021.backup.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\30a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\17a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\15a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\12a.gif.wncryt
<LS_APPDATA>\google\chrome\user data\default\extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.5_0\audio\chime.wav.wncryt
<LS_APPDATA>\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.2.0_0\craw_background.js.wncryt
<LS_APPDATA>\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.2.0_0\craw_window.js.wncryt
<LS_APPDATA>\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.2.0_0\images\flapper.gif.wncryt
<LS_APPDATA>\nichrome\user data\default\web data_20150820130020.backup.wncryt
<LS_APPDATA>\google\chrome\user data\default\preferences_20150820130020.backup.wncryt
%HOMEPATH%\templates\quattro.wb2.wncryt
C:\documents and settings\default user\application data\microsoft\internet explorer\brndlog.bak.wncryt
C:\documents and settings\default user\application data\microsoft\internet explorer\brndlog.txt.wncryt
C:\documents and settings\default user\templates\sndrec.wav.wncryt
%APPDATA%\adobe\acrobat\10.0\javascripts\glob.js.wncryt
%APPDATA%\adobe\acrobat\10.0\javascripts\glob.settings.js.wncryt
%APPDATA%\adobe\acrobat\9.0\javascripts\glob.js.wncryt
C:\autoexec.bat.wncryt
%APPDATA%\adobe\acrobat\9.0\javascripts\glob.settings.js.wncryt
<LS_APPDATA>\google\chrome\user data\default\preferences_20150820125837.backup.wncryt
%HOMEPATH%\cookies\user@atdmt[1].txt.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\04b.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\dance.gif.wncryt
%APPDATA%\telegram desktop\@wanadecryptor@.exe.lnk
%HOMEPATH%\cookies\@please_read_me@.txt
%HOMEPATH%\cookies\@wanadecryptor@.exe
<LS_APPDATA>\@please_read_me@.txt
<LS_APPDATA>\@wanadecryptor@.exe.lnk
%APPDATA%\telegram desktop\log.txt.wncryt
%APPDATA%\telegram desktop\@please_read_me@.txt
<LS_APPDATA>\microsoft\outlook\outlook.pst.wncryt
C:\msocache\all users\{90120000-0030-0000-0000-0000000ff1ce}-c\@please_read_me@.txt
C:\msocache\all users\{90120000-0030-0000-0000-0000000ff1ce}-c\@wanadecryptor@.exe
%ALLUSERSPROFILE%\application data\microsoft\office\data\opa12.bak.wncryt
C:\documents and settings\default user\templates\quattro.wb2.wncryt
%APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif.wncryt
%HOMEPATH%\templates\@please_read_me@.txt
%HOMEPATH%\templates\@wanadecryptor@.exe
%APPDATA%\icqm\icq\html\de\loading\progress_agent.gif.wncryt
%APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif.wncryt
%APPDATA%\mozilla\firefox\profiles\22ie2h77.default\revocations.txt.wncryt
%APPDATA%\icqm\icq\database\citylist_en.csv.wncryt
%APPDATA%\icqm\icq\database\citylist_kz.csv.wncryt
%APPDATA%\icqm\icq\database\citylist_ru.csv.wncryt
%APPDATA%\icqm\icq\database\citylist_tr.csv.wncryt
%APPDATA%\opera software\opera stable\@please_read_me@.txt
%APPDATA%\icq-profile\update\@please_read_me@.txt
%APPDATA%\opera software\opera stable\@wanadecryptor@.exe.lnk
%APPDATA%\icqm\icq\database\citylist_ua.csv.wncryt
%APPDATA%\microsoft\internet explorer\@please_read_me@.txt
%APPDATA%\microsoft\internet explorer\@wanadecryptor@.exe.lnk
%APPDATA%\microsoft\templates\@please_read_me@.txt
%APPDATA%\microsoft\templates\@wanadecryptor@.exe.lnk
%APPDATA%\icqm\icq\database\citylist_uz.csv.wncryt
%APPDATA%\icqm\icq\smiles\skin.txt.wncryt
%APPDATA%\microsoft\internet explorer\brndlog.txt.wncryt
%TEMP%\ixp000.tmp\t.wnry
%APPDATA%\icqm\icq\html\en\loading\progress_agent.gif.wncryt
%APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\duh.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\gangsta.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\guby.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\information.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\joy.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\kot_cool.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\kot_obida.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\kot_wow.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\kisses.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\drako_love.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\drako_koster.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf.wncryt
%APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif.wncryt
%APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif.wncryt
%APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif.wncryt
%APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif.wncryt
%APPDATA%\icqm\icq\smiles\flash\akitaka.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\angel.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\bad_cold.swf.wncryt
%APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif.wncryt
%APPDATA%\icqm\icq\smiles\flash\beback.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\bodun.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\boo.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\canthearu.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\chillout.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\devochka.swf.wncryt
C:\documents and settings\default user\templates\@wanadecryptor@.exe
%APPDATA%\icqm\icq\smiles\flash\beer.swf.wncryt
%APPDATA%\icq-profile\update\@wanadecryptor@.exe.lnk
C:\documents and settings\default user\templates\@please_read_me@.txt
%TEMP%\ixp000.tmp\f.wnry
C:\documents and settings\default user\application data\microsoft\internet explorer\@wanadecryptor@.exe.lnk
%TEMP%\ixp000.tmp\msg\m_korean.wnry
%TEMP%\ixp000.tmp\msg\m_latvian.wnry
%TEMP%\ixp000.tmp\msg\m_norwegian.wnry
%TEMP%\ixp000.tmp\msg\m_polish.wnry
%TEMP%\ixp000.tmp\msg\m_indonesian.wnry
%TEMP%\ixp000.tmp\msg\m_german.wnry
%TEMP%\ixp000.tmp\msg\m_japanese.wnry
%TEMP%\ixp000.tmp\msg\m_portuguese.wnry
%TEMP%\ixp000.tmp\msg\m_spanish.wnry
%TEMP%\ixp000.tmp\msg\m_swedish.wnry
%TEMP%\ixp000.tmp\msg\m_turkish.wnry
%TEMP%\ixp000.tmp\msg\m_vietnamese.wnry
%TEMP%\ixp000.tmp\msg\m_romanian.wnry
%TEMP%\ixp000.tmp\msg\m_russian.wnry
%TEMP%\ixp000.tmp\msg\m_slovak.wnry
%TEMP%\ixp000.tmp\msg\m_greek.wnry
%TEMP%\ixp000.tmp\msg\m_french.wnry
%TEMP%\ixp000.tmp\r.wnry
<LS_APPDATA>\csidl_
<LS_APPDATA>\csidl_x
%TEMP%\ixp000.tmp\b.wnry
%TEMP%\ixp000.tmp\c.wnry
%TEMP%\ixp000.tmp\msg\m_bulgarian.wnry
%TEMP%\ixp000.tmp\msg\m_chinese (simplified).wnry
%TEMP%\ixp000.tmp\k.ab_
%TEMP%\ixp000.tmp\msg\m_chinese (traditional).wnry
%TEMP%\ixp000.tmp\msg\m_czech.wnry
%TEMP%\ixp000.tmp\msg\m_danish.wnry
%TEMP%\ixp000.tmp\msg\m_dutch.wnry
%TEMP%\ixp000.tmp\msg\m_english.wnry
%TEMP%\ixp000.tmp\msg\m_filipino.wnry
%TEMP%\ixp000.tmp\msg\m_finnish.wnry
%TEMP%\ixp000.tmp\msg\m_croatian.wnry
%APPDATA%\icqm\icq\smiles\flash\krizis.swf.wncryt
%APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif.wncryt
%TEMP%\ixp000.tmp\s.wnry
%TEMP%\ixp000.tmp\u.wnry
%HOMEPATH%\desktop\dial.bmp.wncryt
%ALLUSERSPROFILE%\documents\my music\sample music\@please_read_me@.txt
%TEMP%\ixp000.tmp\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\documents\my pictures\sample pictures\@please_read_me@.txt
%HOMEPATH%\desktop\@wanadecryptor@.exe
%ALLUSERSPROFILE%\documents\my pictures\sample pictures\@wanadecryptor@.exe.lnk
%HOMEPATH%\desktop\dashborder_96.bmp.wncryt
%ALLUSERSPROFILE%\documents\my music\sample music\new stories (highway blues).wma.wncryt
C:\@wanadecryptor@.exe
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\@please_read_me@.txt
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\@wanadecryptor@.exe.lnk
C:\documents and settings\default user\application data\microsoft\internet explorer\@please_read_me@.txt
%ALLUSERSPROFILE%\documents\my music\sample music\beethoven's symphony no. 9 (scherzo).wma.wncryt
%TEMP%\ixp000.tmp\msg\m_italian.wnry
C:\@please_read_me@.txt
%HOMEPATH%\desktop\archer.avi.wncryt
%HOMEPATH%\desktop\@please_read_me@.txt
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc.wncryt
%TEMP%\ixp000.tmp\00000000.pky
%TEMP%\ixp000.tmp\00000000.eky
%TEMP%\ixp000.tmp\00000000.res
%TEMP%\ixp000.tmp\@wanadecryptor@.exe
%TEMP%\ixp000.tmp\235461570672304.bat
%TEMP%\ixp000.tmp\taskse.exe
%TEMP%\ixp000.tmp\@please_read_me@.txt
%TEMP%\ixp000.tmp\m.vbs
%HOMEPATH%\desktop\adhd_and_obesity.docx.wncryt
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncryt
%HOMEPATH%\desktop\applicantform_en.doc.wncryt
%HOMEPATH%\desktop\issi2013_template_for_posters.docx.wncryt
%HOMEPATH%\desktop\nwfieldnotes1966.docx.wncryt
%HOMEPATH%\desktop\508softwareandos.doc.wncryt
%HOMEPATH%\desktop\sdszfo.docx.wncryt
%TEMP%\ixp000.tmp\taskdl.exe
%APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\02.gif.wncryt
%APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\smile.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\stop.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\surprised.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thank you.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thumbs up.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\sad.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\scream.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\tongue out.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\biggrin.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\blum1.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\blush.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\bomb.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\bye2.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\air_kiss.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\bad.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\crazy.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\cool.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\listening to music.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\cool.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\crying.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\devil.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\drinking.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\mad.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\bomb.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\nothing to say.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\falling asleep.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissed.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissing.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing out loud (lol).gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\gross.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\in love.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kiss.gif.wncryt
%APPDATA%\icqm\icq\smiles\flash\laugh.swf.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\cry.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\pardon.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\sad.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\scratch_one-s_head.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\shok.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\shout.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\nea.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\smile.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\rofl.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\unknown.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\wink.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\yahoo.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\yes.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\01.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\sorry.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\music.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\wacko1.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\mocking.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\man_in_love.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\diablo.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\gamer.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\girl_angel.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\give_heart.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\give_rose.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\good.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\hang1.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\drinks.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\hi.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\i_am_so_happy.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss3.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\lol.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\mad.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blushing.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\ireful.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\can't say-shut up.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blinking.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\angel.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\cat\cat_paper.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\s008.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\8march\love.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\8march\car.gif.wncryt
%APPDATA%\icqm\icq\smiles\flash\zadolbal.swf.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif.wncryt
%APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\mad dog.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\missyou.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\rabotaet.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\rosy.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\serdze.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\skratch.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\sobaka.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\sorry.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\tank.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\wf_love_srazila.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\smeh.swf.wncryt
%APPDATA%\icqm\icq\smiles\flash\likeu.swf.wncryt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\03a.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\could.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\sing.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\skuka.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\sleep.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\smile.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\rainbow.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\tongue.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\sad.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\wonder.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\cat\cat_hand.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\cat\cat_lick.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\cat\cat_meow.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\cat\cat_mouse.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\victory.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\cat\cat_attack.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\red.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\poison.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\pistolet.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\dance.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\devil.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\eat.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\fight.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\book.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\fingal.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\gg.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\gg2.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\gift.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\history.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\hungry.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\kiss.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\flowr.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\love.gif.wncryt
%APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif.wncryt
C:\msocache\all users\{90120000-0030-0000-0000-0000000ff1ce}-c\enterww.cab.wncryt

Sets the 'hidden' attribute to the following files

<LS_APPDATA>\csidl_
<LS_APPDATA>\csidl_x

Deletes the following files

%TEMP%\ixp000.tmp\m.vbs
%TEMP%\ixp000.tmp\msg\m_indonesian.wnry
%TEMP%\ixp000.tmp\msg\m_italian.wnry
%TEMP%\ixp000.tmp\msg\m_japanese.wnry
%TEMP%\ixp000.tmp\msg\m_korean.wnry
%TEMP%\ixp000.tmp\msg\m_latvian.wnry
%TEMP%\ixp000.tmp\msg\m_norwegian.wnry
%TEMP%\ixp000.tmp\msg\m_polish.wnry
%TEMP%\ixp000.tmp\msg\m_portuguese.wnry
%TEMP%\ixp000.tmp\msg\m_romanian.wnry
%TEMP%\ixp000.tmp\msg\m_russian.wnry
%TEMP%\ixp000.tmp\msg\m_slovak.wnry
%TEMP%\ixp000.tmp\msg\m_spanish.wnry
%TEMP%\ixp000.tmp\msg\m_swedish.wnry
%TEMP%\ixp000.tmp\msg\m_turkish.wnry
%TEMP%\ixp000.tmp\msg\m_vietnamese.wnry
%TEMP%\ixp000.tmp\r.wnry
%TEMP%\ixp000.tmp\s.wnry
%TEMP%\ixp000.tmp\t.wnry
%TEMP%\ixp000.tmp\taskdl.exe
%TEMP%\ixp000.tmp\msg\m_greek.wnry
%TEMP%\ixp000.tmp\taskse.exe
%TEMP%\ixp000.tmp\msg\m_german.wnry
%TEMP%\ixp000.tmp\msg\m_finnish.wnry
%TEMP%\ixp000.tmp\k.ab_
%TEMP%\ixp000.tmp\k.abc
%TEMP%\ixp000.tmp\00000000.pky
%TEMP%\ixp000.tmp\00000000.res
%TEMP%\ixp000.tmp\@please_read_me@.txt
%TEMP%\ixp000.tmp\@wanadecryptor@.exe
%TEMP%\ixp000.tmp\@wanadecryptor@.exe.lnk
%TEMP%\ixp000.tmp\b.wnry
%TEMP%\ixp000.tmp\c.wnry
%TEMP%\ixp000.tmp\f.wnry
%TEMP%\ixp000.tmp\msg\m_bulgarian.wnry
%TEMP%\ixp000.tmp\msg\m_chinese (simplified).wnry
%TEMP%\ixp000.tmp\msg\m_chinese (traditional).wnry
%TEMP%\ixp000.tmp\msg\m_croatian.wnry
%TEMP%\ixp000.tmp\msg\m_czech.wnry
%TEMP%\ixp000.tmp\msg\m_danish.wnry
%TEMP%\ixp000.tmp\msg\m_dutch.wnry
%TEMP%\ixp000.tmp\msg\m_english.wnry
%TEMP%\ixp000.tmp\msg\m_filipino.wnry
%TEMP%\ixp000.tmp\msg\m_french.wnry
%TEMP%\ixp000.tmp\u.wnry

Moves the following files

from %HOMEPATH%\desktop\508softwareandos.doc.wncryt to %HOMEPATH%\desktop\508softwareandos.doc.wncry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\jealousy.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\valentine\jealousy.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\in_love.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\valentine\in_love.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\dont_be_late.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\valentine\dont_be_late.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\broken_heart.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\valentine\broken_heart.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\zloradstvo.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\zloradstvo.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\vampire.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\vampire.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\smile.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\smile.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\shy.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\shy.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\sceptic.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\sceptic.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\rrr.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\rrr.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\really.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\really.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\pig.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\pig.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\oo.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\oo.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\kiss.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\kiss.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\kissed.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\valentine\kissed.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\hm.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\hm.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\heart.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\heart.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\disappointed.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\disappointed.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\cry.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\cry.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\coolguy.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\coolguy.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\bullshit.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\bullshit.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\blink.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\blink.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\bee.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\bee.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\bazilio.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\bazilio.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\ass.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\ass.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\angry.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\angry.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s020.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set06\s020.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\laughter.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\laughter.gif.wncry
from %APPDATA%\opera software\opera stable\bookmarks_20150820125840.backup.wncryt to %APPDATA%\opera software\opera stable\bookmarks_20150820125840.backup.wncry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\lets_play.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\valentine\lets_play.gif.wncry
from %APPDATA%\opera software\opera stable\bookmarks_20150820125838.backup.wncryt to %APPDATA%\opera software\opera stable\bookmarks_20150820125838.backup.wncry
from %APPDATA%\opera software\opera stable\bookmarks.bak.wncryt to %APPDATA%\opera software\opera stable\bookmarks.bak.wncry
from %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\user.js.wncryt to %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\user.js.wncry
from %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\secmod.db.wncryt to %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\secmod.db.wncry
from %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\prefs.js_20150820130023.backup.wncryt to %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\prefs.js_20150820130023.backup.wncry
from %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\prefs.js_20150820125841.backup.wncryt to %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\prefs.js_20150820125841.backup.wncry
from %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\prefs.js.wncryt to %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\prefs.js.wncry
from %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\key3.db.wncryt to %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\key3.db.wncry
from %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\cert8.db.wncryt to %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\cert8.db.wncry
from %APPDATA%\microsoft\templates\normal.dotm.wncryt to %APPDATA%\microsoft\templates\normal.dotm.wncry
from %APPDATA%\microsoft\document building blocks\1033\building blocks.dotx.wncryt to %APPDATA%\microsoft\document building blocks\1033\building blocks.dotx.wncry
from %APPDATA%\icqm\icq\video\video.swf.wncryt to %APPDATA%\icqm\icq\video\video.swf.wncry
from %APPDATA%\icqm\icq\sounds\voiceend.wav.wncryt to %APPDATA%\icqm\icq\sounds\voiceend.wav.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s019.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set06\s019.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\kiss.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\valentine\kiss.gif.wncry
from %APPDATA%\icqm\icq\sounds\ring.mp3.wncryt to %APPDATA%\icqm\icq\sounds\ring.mp3.wncry
from %APPDATA%\icqm\icq\sounds\otprav.wav.wncryt to %APPDATA%\icqm\icq\sounds\otprav.wav.wncry
from %APPDATA%\icqm\icq\sounds\otprav.mp3.wncryt to %APPDATA%\icqm\icq\sounds\otprav.mp3.wncry
from %APPDATA%\icqm\icq\sounds\no_answer.wav.wncryt to %APPDATA%\icqm\icq\sounds\no_answer.wav.wncry
from %APPDATA%\icqm\icq\sounds\message.mp3.wncryt to %APPDATA%\icqm\icq\sounds\message.mp3.wncry
from %APPDATA%\icqm\icq\sounds\letter.wav.wncryt to %APPDATA%\icqm\icq\sounds\letter.wav.wncry
from %APPDATA%\icqm\icq\sounds\error.wav.wncryt to %APPDATA%\icqm\icq\sounds\error.wav.wncry
from %APPDATA%\icqm\icq\sounds\conference.mp3.wncryt to %APPDATA%\icqm\icq\sounds\conference.mp3.wncry
from %APPDATA%\icqm\icq\sounds\call_in.wav.wncryt to %APPDATA%\icqm\icq\sounds\call_in.wav.wncry
from %APPDATA%\icqm\icq\sounds\busy.mp3.wncryt to %APPDATA%\icqm\icq\sounds\busy.mp3.wncry
from %APPDATA%\icqm\icq\sounds\auth.mp3.wncryt to %APPDATA%\icqm\icq\sounds\auth.mp3.wncry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\want_you.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\valentine\want_you.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\undress.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\valentine\undress.gif.wncry
from %APPDATA%\icqm\icq\sounds\start.wav.wncryt to %APPDATA%\icqm\icq\sounds\start.wav.wncry
from %APPDATA%\icqm\icq\smiles\smiles\valentine\on_wings.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\valentine\on_wings.gif.wncry
from %APPDATA%\icqm\icq\sounds\test_sound.wav.wncryt to %APPDATA%\icqm\icq\sounds\test_sound.wav.wncry
from %APPDATA%\opera software\opera stable\bookmarks_20150820125839.backup.wncryt to %APPDATA%\opera software\opera stable\bookmarks_20150820125839.backup.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s016.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set06\s016.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s003.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s003.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s016.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set04\s016.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s015.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set04\s015.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s014.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set04\s014.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s013.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set04\s013.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s012.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set04\s012.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s011.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set04\s011.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s010.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set04\s010.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s009.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set04\s009.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s008.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set04\s008.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s007.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set04\s007.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s006.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set04\s006.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s005.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set04\s005.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s004.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set04\s004.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s003.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set04\s003.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s002.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set04\s002.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set04\s001.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set04\s001.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\yahoo.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\yahoo.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\wink.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\wink.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\wacko2.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\wacko2.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\unknw.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\unknw.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\smile.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\smile.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\shout.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\shout.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\shok.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\shok.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\scratch_one-s_head.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\scratch_one-s_head.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\sad.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\sad.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\rolleyes.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\rolleyes.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s004.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s004.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s005.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s005.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s015.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set06\s015.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s019.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s019.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s020.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s020.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s014.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set06\s014.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s013.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set06\s013.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s012.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set06\s012.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s011.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set06\s011.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s010.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set06\s010.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s009.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set06\s009.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s008.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set06\s008.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s006.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set06\s006.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s004.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set06\s004.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s003.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set06\s003.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s002.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set06\s002.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s001.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set06\s001.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s018.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set06\s018.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set06\s017.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set06\s017.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s001.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s001.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s017.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s017.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s016.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s016.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s015.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s015.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s014.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s014.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s013.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s013.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s012.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s012.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s011.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s011.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s010.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s010.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s009.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s009.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s008.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s008.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s007.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s007.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s006.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s006.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s018.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s018.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\bye2.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\bye2.gif.wncry
from %APPDATA%\opera software\opera stable\bookmarks_20150820125841.backup.wncryt to %APPDATA%\opera software\opera stable\bookmarks_20150820125841.backup.wncry
from %HOMEPATH%\cookies\user@atdmt[1].txt.wncryt to %HOMEPATH%\cookies\user@atdmt[1].txt.wncry
from %HOMEPATH%\cookies\user@adobe[1].txt.wncryt to %HOMEPATH%\cookies\user@adobe[1].txt.wncry
from %HOMEPATH%\cookies\user@adnxs[1].txt.wncryt to %HOMEPATH%\cookies\user@adnxs[1].txt.wncry
from %HOMEPATH%\cookies\user@7ba[1].txt.wncryt to %HOMEPATH%\cookies\user@7ba[1].txt.wncry
from %HOMEPATH%\cookies\user@326944[1].txt.wncryt to %HOMEPATH%\cookies\user@326944[1].txt.wncry
from %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt.wncryt to %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt.wncry
from %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\sessionstore-backups\recovery.js.wncryt to %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\sessionstore-backups\recovery.js.wncry
from %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\sessionstore-backups\previous.js.wncryt to %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\sessionstore-backups\previous.js.wncry
from %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\sitesecurityservicestate.txt.wncryt to %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\sitesecurityservicestate.txt.wncry
from %APPDATA%\microsoft\internet explorer\brndlog.bak.wncryt to %APPDATA%\microsoft\internet explorer\brndlog.bak.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\victory.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\victory.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\think.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\think.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\tears.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\tears.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\sleepy.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\sleepy.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\ok.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\ok.gif.wncry
from %HOMEPATH%\cookies\user@c.bing[1].txt.wncryt to %HOMEPATH%\cookies\user@c.bing[1].txt.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\live.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\live.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\kukes.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\kukes.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_right.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_right.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_left.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_left.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\fuck.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\fuck.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\fist.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\fist.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\die.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\die.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\devil.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\devil.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\detzl.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\detzl.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\crocodile.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\crocodile.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\biggrin.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\biggrin.gif.wncry
from %HOMEPATH%\cookies\user@bing[1].txt.wncryt to %HOMEPATH%\cookies\user@bing[1].txt.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\plug.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\plug.gif.wncry
from %APPDATA%\opera software\opera stable\bookmarks_20150820130020.backup.wncryt to %APPDATA%\opera software\opera stable\bookmarks_20150820130020.backup.wncry
from %HOMEPATH%\cookies\user@c.msn[1].txt.wncryt to %HOMEPATH%\cookies\user@c.msn[1].txt.wncry
from <LS_APPDATA>\google\chrome\user data\default\service worker\cachestorage\b5828dd7cc3b943f8890a5bb6e3b1b63e8ee8703\index.txt.wncryt to <LS_APPDATA>\google\chrome\user data\default\service worker\cachestorage\b5828dd7cc3b943f8890a5bb6e3b1b63e8ee8703\index.txt.wncry
from <LS_APPDATA>\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\main.js.wncryt to <LS_APPDATA>\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\main.js.wncry
from <LS_APPDATA>\google\chrome\user data\default\bookmarks_20150820130020.backup.wncryt to <LS_APPDATA>\google\chrome\user data\default\bookmarks_20150820130020.backup.wncry
from <LS_APPDATA>\google\chrome\user data\chrome_shutdown_ms.txt.wncryt to <LS_APPDATA>\google\chrome\user data\chrome_shutdown_ms.txt.wncry
from <LS_APPDATA>\chromium\user data\default\preferences_20150820130020.backup.wncryt to <LS_APPDATA>\chromium\user data\default\preferences_20150820130020.backup.wncry
from <LS_APPDATA>\chromium\user data\default\bookmarks_20150820130020.backup.wncryt to <LS_APPDATA>\chromium\user data\default\bookmarks_20150820130020.backup.wncry
from %HOMEPATH%\cookies\user@yandex[2].txt.wncryt to %HOMEPATH%\cookies\user@yandex[2].txt.wncry
from %HOMEPATH%\cookies\user@yadro[1].txt.wncryt to %HOMEPATH%\cookies\user@yadro[1].txt.wncry
from %HOMEPATH%\cookies\user@www.msn[1].txt.wncryt to %HOMEPATH%\cookies\user@www.msn[1].txt.wncry
from %HOMEPATH%\cookies\user@winrar.softkey[2].txt.wncryt to %HOMEPATH%\cookies\user@winrar.softkey[2].txt.wncry
from %HOMEPATH%\cookies\user@win-rar[1].txt.wncryt to %HOMEPATH%\cookies\user@win-rar[1].txt.wncry
from %HOMEPATH%\cookies\user@softkey[2].txt.wncryt to %HOMEPATH%\cookies\user@softkey[2].txt.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\biganger.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\biganger.gif.wncry
from %HOMEPATH%\cookies\user@serving-sys[2].txt.wncryt to %HOMEPATH%\cookies\user@serving-sys[2].txt.wncry
from %HOMEPATH%\cookies\user@bluekai[2].txt.wncryt to %HOMEPATH%\cookies\user@bluekai[2].txt.wncry
from %HOMEPATH%\cookies\user@rambler[2].txt.wncryt to %HOMEPATH%\cookies\user@rambler[2].txt.wncry
from %HOMEPATH%\cookies\user@rabotaetvse[1].txt.wncryt to %HOMEPATH%\cookies\user@rabotaetvse[1].txt.wncry
from %HOMEPATH%\cookies\user@point4all[2].txt.wncryt to %HOMEPATH%\cookies\user@point4all[2].txt.wncry
from %HOMEPATH%\cookies\user@opera[1].txt.wncryt to %HOMEPATH%\cookies\user@opera[1].txt.wncry
from %HOMEPATH%\cookies\user@openstat[1].txt.wncryt to %HOMEPATH%\cookies\user@openstat[1].txt.wncry
from %HOMEPATH%\cookies\user@msn[1].txt.wncryt to %HOMEPATH%\cookies\user@msn[1].txt.wncry
from %HOMEPATH%\cookies\user@mon.softkey[2].txt.wncryt to %HOMEPATH%\cookies\user@mon.softkey[2].txt.wncry
from %HOMEPATH%\cookies\user@microsoft[1].txt.wncryt to %HOMEPATH%\cookies\user@microsoft[1].txt.wncry
from %HOMEPATH%\cookies\user@mail[1].txt.wncryt to %HOMEPATH%\cookies\user@mail[1].txt.wncry
from %HOMEPATH%\cookies\user@help.softkey[3].txt.wncryt to %HOMEPATH%\cookies\user@help.softkey[3].txt.wncry
from %HOMEPATH%\cookies\user@help.softkey[2].txt.wncryt to %HOMEPATH%\cookies\user@help.softkey[2].txt.wncry
from %HOMEPATH%\cookies\user@d.castplatform[2].txt.wncryt to %HOMEPATH%\cookies\user@d.castplatform[2].txt.wncry
from %HOMEPATH%\cookies\user@scorecardresearch[2].txt.wncryt to %HOMEPATH%\cookies\user@scorecardresearch[2].txt.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\amazed.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\amazed.gif.wncry
from <LS_APPDATA>\nichrome\user data\default\bookmarks_20150820130020.backup.wncryt to <LS_APPDATA>\nichrome\user data\default\bookmarks_20150820130020.backup.wncry
from %APPDATA%\icqm\icq\smiles\smiles\smiles\aaa.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\smiles\aaa.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\give_rose.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\give_rose.gif.wncry
from C:\documents and settings\default user\application data\microsoft\internet explorer\brndlog.bak.wncryt to C:\documents and settings\default user\application data\microsoft\internet explorer\brndlog.bak.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\rofl.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\rofl.gif.wncry
from %HOMEPATH%\templates\quattro.wb2.wncryt to %HOMEPATH%\templates\quattro.wb2.wncry
from <LS_APPDATA>\nichrome\user data\default\web data_20150820130020.backup.wncryt to <LS_APPDATA>\nichrome\user data\default\web data_20150820130020.backup.wncry
from <LS_APPDATA>\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.2.0_0\images\flapper.gif.wncryt to <LS_APPDATA>\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.2.0_0\images\flapper.gif.wncry
from <LS_APPDATA>\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.2.0_0\craw_window.js.wncryt to <LS_APPDATA>\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.2.0_0\craw_window.js.wncry
from <LS_APPDATA>\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.2.0_0\craw_background.js.wncryt to <LS_APPDATA>\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.2.0_0\craw_background.js.wncry
from <LS_APPDATA>\google\chrome\user data\default\extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.5_0\audio\chime.wav.wncryt to <LS_APPDATA>\google\chrome\user data\default\extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.5_0\audio\chime.wav.wncry
from <LS_APPDATA>\google\chrome\user data\default\databases\databases.db.wncryt to <LS_APPDATA>\google\chrome\user data\default\databases\databases.db.wncry
from <LS_APPDATA>\google\chrome\user data\default\preferences_20150820130020.backup.wncryt to <LS_APPDATA>\google\chrome\user data\default\preferences_20150820130020.backup.wncry
from <LS_APPDATA>\google\chrome\user data\default\preferences_20150820125837.backup.wncryt to <LS_APPDATA>\google\chrome\user data\default\preferences_20150820125837.backup.wncry
from <LS_APPDATA>\google\chrome\user data\default\bookmarks.bak.wncryt to <LS_APPDATA>\google\chrome\user data\default\bookmarks.bak.wncry
from <LS_APPDATA>\chromium\user data\default\web data_20150820130020.backup.wncryt to <LS_APPDATA>\chromium\user data\default\web data_20150820130020.backup.wncry
from C:\documents and settings\default user\application data\microsoft\internet explorer\brndlog.txt.wncryt to C:\documents and settings\default user\application data\microsoft\internet explorer\brndlog.txt.wncry
from C:\documents and settings\default user\templates\sndrec.wav.wncryt to C:\documents and settings\default user\templates\sndrec.wav.wncry
from <LS_APPDATA>\iconcache.db.wncryt to <LS_APPDATA>\iconcache.db.wncry
from %APPDATA%\thunderbird\profiles\cr5sc40q.default\key3.db.wncryt to %APPDATA%\thunderbird\profiles\cr5sc40q.default\key3.db.wncry
from %APPDATA%\thunderbird\profiles\cr5sc40q.default\cert8.db.wncryt to %APPDATA%\thunderbird\profiles\cr5sc40q.default\cert8.db.wncry
from %APPDATA%\opera software\opera stable\web data_20150820130020.backup.wncryt to %APPDATA%\opera software\opera stable\web data_20150820130020.backup.wncry
from %APPDATA%\opera software\opera stable\web data_20150820125838.backup.wncryt to %APPDATA%\opera software\opera stable\web data_20150820125838.backup.wncry
from %APPDATA%\opera software\opera stable\thumbnails.db.wncryt to %APPDATA%\opera software\opera stable\thumbnails.db.wncry
from %APPDATA%\opera software\opera stable\preferences_20150820130020.backup.wncryt to %APPDATA%\opera software\opera stable\preferences_20150820130020.backup.wncry
from %APPDATA%\opera software\opera stable\preferences_20150820125838.backup.wncryt to %APPDATA%\opera software\opera stable\preferences_20150820125838.backup.wncry
from %APPDATA%\opera software\opera stable\favorites.db.wncryt to %APPDATA%\opera software\opera stable\favorites.db.wncry
from %APPDATA%\opera software\opera stable\browser.js.wncryt to %APPDATA%\opera software\opera stable\browser.js.wncry
from %APPDATA%\opera software\opera stable\bookmarks_20150820130023.backup.wncryt to %APPDATA%\opera software\opera stable\bookmarks_20150820130023.backup.wncry
from %APPDATA%\opera software\opera stable\bookmarks_20150820130022.backup.wncryt to %APPDATA%\opera software\opera stable\bookmarks_20150820130022.backup.wncry
from %APPDATA%\opera software\opera stable\bookmarks_20150820130021.backup.wncryt to %APPDATA%\opera software\opera stable\bookmarks_20150820130021.backup.wncry
from %APPDATA%\thunderbird\profiles\cr5sc40q.default\secmod.db.wncryt to %APPDATA%\thunderbird\profiles\cr5sc40q.default\secmod.db.wncry
from %APPDATA%\thunderbird\profiles\cr5sc40q.default\prefs.js.wncryt to %APPDATA%\thunderbird\profiles\cr5sc40q.default\prefs.js.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set05\s002.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set05\s002.gif.wncry
from %APPDATA%\adobe\acrobat\10.0\javascripts\glob.settings.js.wncryt to %APPDATA%\adobe\acrobat\10.0\javascripts\glob.settings.js.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\29a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\29a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\30a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\30a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\46a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\46a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\43a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\43a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\42a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\42a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\40a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\40a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\39a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\39a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\38a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\38a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\37.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\37.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\36a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\36a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\34a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\34a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\33a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\33a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\32a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\32a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\31a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\31a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\biggrin.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\biggrin.gif.wncry
from %APPDATA%\adobe\acrobat\10.0\javascripts\glob.js.wncryt to %APPDATA%\adobe\acrobat\10.0\javascripts\glob.js.wncry
from C:\autoexec.bat.wncryt to C:\autoexec.bat.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\24a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\24a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\23a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\23a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\22a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\22a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\21a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\21a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\20a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\20a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\19a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\19a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\17a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\17a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\16a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\16a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\15a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\15a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\12a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\12a.gif.wncry
from %APPDATA%\adobe\acrobat\9.0\javascripts\glob.settings.js.wncryt to %APPDATA%\adobe\acrobat\9.0\javascripts\glob.settings.js.wncry
from %APPDATA%\adobe\acrobat\9.0\javascripts\glob.js.wncryt to %APPDATA%\adobe\acrobat\9.0\javascripts\glob.js.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\25a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\25a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\pardon.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\pardon.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\nea.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\nea.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\music.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\music.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\8march\love.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\8march\love.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\8march\car.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\8march\car.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\s008.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\s008.gif.wncry
from %APPDATA%\icqm\icq\smiles\flash\zadolbal.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\zadolbal.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\wf_love_srazila.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\wf_love_srazila.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\tank.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\tank.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\sorry.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\sorry.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\sobaka.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\sobaka.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\smeh.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\smeh.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\skratch.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\skratch.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\serdze.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\serdze.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\rosy.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\rosy.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\rabotaet.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\rabotaet.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\missyou.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\missyou.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\mad dog.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\mad dog.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\likeu.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\likeu.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\laugh.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\laugh.swf.wncry
from %APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\rainbow.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\rainbow.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\devil.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\devil.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\eat.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\eat.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\poison.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\poison.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\pistolet.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\pistolet.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\love.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\love.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\kiss.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\kiss.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\hungry.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\hungry.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\history.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\history.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\gift.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\gift.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\gg2.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\gg2.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\gg.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\gg.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\flowr.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\flowr.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\fingal.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\fingal.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\fight.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\fight.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif.wncry
from %APPDATA%\icqm\icq\smiles\flash\krizis.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\krizis.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\could.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\could.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\book.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\book.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\dance.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\dance.gif.wncry
from %APPDATA%\icqm\icq\smiles\flash\kot_wow.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\kot_wow.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\kot_obida.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\kot_obida.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf.wncry
from %APPDATA%\icqm\icq\database\citylist_kz.csv.wncryt to %APPDATA%\icqm\icq\database\citylist_kz.csv.wncry
from %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif.wncryt to %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif.wncry
from %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif.wncryt to %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif.wncry
from C:\documents and settings\default user\templates\quattro.wb2.wncryt to C:\documents and settings\default user\templates\quattro.wb2.wncry
from %ALLUSERSPROFILE%\application data\microsoft\office\data\opa12.bak.wncryt to %ALLUSERSPROFILE%\application data\microsoft\office\data\opa12.bak.wncry
from <LS_APPDATA>\microsoft\outlook\outlook.pst.wncryt to <LS_APPDATA>\microsoft\outlook\outlook.pst.wncry
from %APPDATA%\telegram desktop\log.txt.wncryt to %APPDATA%\telegram desktop\log.txt.wncry
from %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\revocations.txt.wncryt to %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\revocations.txt.wncry
from %APPDATA%\microsoft\internet explorer\brndlog.txt.wncryt to %APPDATA%\microsoft\internet explorer\brndlog.txt.wncry
from %APPDATA%\icqm\icq\smiles\skin.txt.wncryt to %APPDATA%\icqm\icq\smiles\skin.txt.wncry
from %APPDATA%\icqm\icq\database\citylist_uz.csv.wncryt to %APPDATA%\icqm\icq\database\citylist_uz.csv.wncry
from %APPDATA%\icqm\icq\database\citylist_ua.csv.wncryt to %APPDATA%\icqm\icq\database\citylist_ua.csv.wncry
from %APPDATA%\icqm\icq\database\citylist_tr.csv.wncryt to %APPDATA%\icqm\icq\database\citylist_tr.csv.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\red.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\red.gif.wncry
from %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif.wncryt to %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif.wncry
from %APPDATA%\icqm\icq\database\citylist_en.csv.wncryt to %APPDATA%\icqm\icq\database\citylist_en.csv.wncry
from %ALLUSERSPROFILE%\documents\my music\sample music\new stories (highway blues).wma.wncryt to %ALLUSERSPROFILE%\documents\my music\sample music\new stories (highway blues).wma.wncry
from %ALLUSERSPROFILE%\documents\my music\sample music\beethoven's symphony no. 9 (scherzo).wma.wncryt to %ALLUSERSPROFILE%\documents\my music\sample music\beethoven's symphony no. 9 (scherzo).wma.wncry
from %HOMEPATH%\desktop\dial.bmp.wncryt to %HOMEPATH%\desktop\dial.bmp.wncry
from %HOMEPATH%\desktop\dashborder_96.bmp.wncryt to %HOMEPATH%\desktop\dashborder_96.bmp.wncry
from %HOMEPATH%\desktop\archer.avi.wncryt to %HOMEPATH%\desktop\archer.avi.wncry
from %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc.wncryt to %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc.wncry
from %HOMEPATH%\desktop\sdszfo.docx.wncryt to %HOMEPATH%\desktop\sdszfo.docx.wncry
from %HOMEPATH%\desktop\nwfieldnotes1966.docx.wncryt to %HOMEPATH%\desktop\nwfieldnotes1966.docx.wncry
from %HOMEPATH%\desktop\issi2013_template_for_posters.docx.wncryt to %HOMEPATH%\desktop\issi2013_template_for_posters.docx.wncry
from %HOMEPATH%\desktop\applicantform_en.doc.wncryt to %HOMEPATH%\desktop\applicantform_en.doc.wncry
from %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncryt to %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncry
from %HOMEPATH%\desktop\adhd_and_obesity.docx.wncryt to %HOMEPATH%\desktop\adhd_and_obesity.docx.wncry
from %APPDATA%\icqm\icq\database\citylist_ru.csv.wncryt to %APPDATA%\icqm\icq\database\citylist_ru.csv.wncry
from <LS_APPDATA>\nichrome\user data\default\preferences_20150820130020.backup.wncryt to <LS_APPDATA>\nichrome\user data\default\preferences_20150820130020.backup.wncry
from %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif.wncryt to %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif.wncry
from %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif.wncryt to %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif.wncry
from %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif.wncryt to %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif.wncry
from %APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\kot_cool.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\kot_cool.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\kisses.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\kisses.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\joy.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\joy.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\information.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\information.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\guby.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\guby.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\gangsta.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\gangsta.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\duh.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\duh.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf.wncry
from %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif.wncryt to %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif.wncry
from %APPDATA%\icqm\icq\smiles\flash\drako_love.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\drako_love.swf.wncry
from %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif.wncryt to %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif.wncry
from %APPDATA%\icqm\icq\smiles\flash\devochka.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\devochka.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\chillout.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\chillout.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\canthearu.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\canthearu.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\boo.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\boo.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\bodun.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\bodun.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\beer.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\beer.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\beback.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\beback.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\angel.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\angel.swf.wncry
from %APPDATA%\icqm\icq\smiles\flash\akitaka.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\akitaka.swf.wncry
from %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif.wncryt to %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif.wncry
from %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif.wncryt to %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif.wncry
from %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf.wncryt to %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf.wncry
from %HOMEPATH%\cookies\user@rarlab[1].txt.wncryt to %HOMEPATH%\cookies\user@rarlab[1].txt.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\sad.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\sad.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\sleep.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\sleep.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\unknown.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\unknown.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\10a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\10a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\09a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\09a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\08a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\08a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\07a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\07a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\06a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\06a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\04b.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\04b.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\03a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\03a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\02.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\02.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\01.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\01.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\yes.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\yes.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\yahoo.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\yahoo.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\wink.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\wink.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\wacko1.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\wacko1.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\sorry.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\sorry.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\13a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\13a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\smile.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\smile.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\shout.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\shout.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\shok.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\shok.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\scratch_one-s_head.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\scratch_one-s_head.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\sad.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\sad.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\rofl.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\rofl.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\pardon.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\pardon.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\nea.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\nea.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\music.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\music.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\mocking.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\mocking.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\man_in_love.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\man_in_love.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\14a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\14a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\mocking.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\mocking.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\bad.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\bad.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\blum.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\blum.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\man_in_love.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\man_in_love.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\kiss_mini.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\kiss_mini.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\good.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\good.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\fool.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\fool.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\facepalm.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\facepalm.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\drinks.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\drinks.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\dirol.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\dirol.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\diablo.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\diablo.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\dance.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\dance.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\crazy.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\crazy.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\cray.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\cray.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\blush.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\blush.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\mad.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\mad.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\lol.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\lol.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\26a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\26a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\53a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\53a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\52a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\52a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\51a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\51a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\50a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\50a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\49a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\49a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\48a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\48a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\47a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\47a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\45a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\45a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\44a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\44a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\41b.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\41b.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\28a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\28a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\27a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\27a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\set03\angel.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\set03\angel.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\11a.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\11a.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss3.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss3.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\sing.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\sing.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blushing.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blushing.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing out loud (lol).gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing out loud (lol).gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissing.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissing.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissed.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissed.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kiss.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kiss.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\in love.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\in love.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\gross.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\gross.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\falling asleep.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\falling asleep.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\drinking.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\drinking.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\devil.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\devil.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\crying.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\crying.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\cool.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\cool.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\mad.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\mad.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\can't say-shut up.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\can't say-shut up.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\bomb.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\bomb.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blinking.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blinking.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\angel.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\angel.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_paper.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_paper.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_mouse.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_mouse.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_meow.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_meow.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_lick.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_lick.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_hand.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_hand.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_attack.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_attack.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\wonder.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\wonder.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\victory.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\victory.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\tongue.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\tongue.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\smile.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\smile.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\listening to music.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\listening to music.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\animated\skuka.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\animated\skuka.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\sad.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\sad.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\smile.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\smile.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\i_am_so_happy.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\i_am_so_happy.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\nothing to say.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\nothing to say.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\ireful.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\ireful.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\hi.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\hi.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\hang1.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\hang1.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\good.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\good.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_rose.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_rose.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_heart.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_heart.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\girl_angel.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\girl_angel.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\gamer.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\gamer.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\drinks.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\drinks.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\diablo.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\diablo.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\dance.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\dance.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\scream.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\scream.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\cry.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\cry.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\cool.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\cool.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\bomb.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\bomb.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\blush.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\blush.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\blum1.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\blum1.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\biggrin.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\biggrin.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\bad.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\bad.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\air_kiss.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\air_kiss.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\tongue out.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\tongue out.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thumbs up.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thumbs up.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thank you.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thank you.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\surprised.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\surprised.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\stop.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\stop.gif.wncry
from %APPDATA%\icqm\icq\smiles\smiles\koloboks\crazy.gif.wncryt to %APPDATA%\icqm\icq\smiles\smiles\koloboks\crazy.gif.wncry
from %HOMEPATH%\templates\sndrec.wav.wncryt to %HOMEPATH%\templates\sndrec.wav.wncry

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: 'Progman' WindowName: ''

Creates and executes the following

'%TEMP%\ixp000.tmp\k.abc'
'%TEMP%\ixp000.tmp\taskdl.exe'
'<SYSTEM32>\cmd.exe' /c echo on error resume next:CreateObject("WScript.Shell").Run "%TEMP%\IXP000.TMP\K.abc",1: >"%HOMEPATH%\Start Menu\Programs\Startup\x.vbs"' (with hidden window)
'<SYSTEM32>\attrib.exe' +h .' (with hidden window)
'%TEMP%\ixp000.tmp\taskdl.exe' ' (with hidden window)
'<SYSTEM32>\cmd.exe' /c 235461570672304.bat' (with hidden window)
'<SYSTEM32>\attrib.exe' +h +s D:\$RECYCLE' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c echo on error resume next:CreateObject("WScript.Shell").Run "%TEMP%\IXP000.TMP\K.abc",1: >"%HOMEPATH%\Start Menu\Programs\Startup\x.vbs"
'<SYSTEM32>\attrib.exe' +h .
'<SYSTEM32>\cmd.exe' /c 235461570672304.bat
'<SYSTEM32>\cscript.exe' //nologo m.vbs
'<SYSTEM32>\attrib.exe' +h +s D:\$RECYCLE

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial