Trojan.Encoder.31698

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1' = '"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"'

Changes the following executable system files

%WINDIR%\microsoft.net\framework\v4.0.30319\en-us\microsoft.windows.applicationserver.applications.dll.mui
%WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelevents.dll.mui
%WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelinstallrc.dll.mui
%WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelperformancecounters.dll.mui
%WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelregui.dll.mui
%WINDIR%\microsoft.net\framework\v4.0.30319\en-us\workflowservicehostperformancecounters.dll.mui
%WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.jscript.tlb
%WINDIR%\microsoft.net\framework\v4.0.30319\mscoree.tlb
%WINDIR%\microsoft.net\framework\v4.0.30319\mscorlib.tlb
%WINDIR%\microsoft.net\framework\v4.0.30319\system.drawing.tlb
%WINDIR%\microsoft.net\framework\v4.0.30319\system.enterpriseservices.tlb
%WINDIR%\microsoft.net\framework\v4.0.30319\system.tlb
%WINDIR%\microsoft.net\framework\v4.0.30319\system.web.tlb
%WINDIR%\microsoft.net\framework\v4.0.30319\system.windows.forms.tlb
%WINDIR%\microsoft.net\framework\v4.0.30319\wpf\en-us\presentationhost_v0400.dll.mui

Creates the following files on removable media

<Drive name for removable media>:\split.avi
<Drive name for removable media>:\advice_process.htm
<Drive name for removable media>:\ituneshelpunavailable.htm
<Drive name for removable media>:\tree_view.htm
<Drive name for removable media>:\thlps_keeper_mayer_1965.docx
<Drive name for removable media>:\file_p_00000000_1371597592.docx
<Drive name for removable media>:\sdszfo.docx
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\delete.avi
<Drive name for removable media>:\garden.htm
<Drive name for removable media>:\about.html

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)

deletes volume shadow copies.

Injects code into

the following system processes:

%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
<SYSTEM32>\vssvc.exe
<SYSTEM32>\wbengine.exe
<SYSTEM32>\vds.exe

Modifies file system

Creates the following files

%WINDIR%\logs\windowsbackup\wbadmin.0.etl

Moves the following system files

from %WINDIR%\microsoft.net\framework\v4.0.30319\adonetdiag.mof to %WINDIR%\microsoft.net\framework\v4.0.30319\adonetdiag.mof.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\installroles.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installroles.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\installsqlstate.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installsqlstate.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\installsqlstatetemplate.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installsqlstatetemplate.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\installwebeventsqlprovider.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installwebeventsqlprovider.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\locale.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\locale.nlp.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.build.xsd to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.build.xsd.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.common.overridetasks to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.common.overridetasks.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.common.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.common.targets.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.common.tasks to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.common.tasks.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.csharp.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.csharp.targets.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.data.entity.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.data.entity.targets.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.jscript.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.jscript.tlb.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\installpersonalization.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installpersonalization.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\installprofile.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installprofile.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.netframework.props to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.netframework.props.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.visualbasic.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.visualbasic.targets.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.windows.applicationserver.applications.45.man to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.windows.applicationserver.applications.45.man.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.winfx.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.winfx.targets.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.workflowbuildextensions.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.workflowbuildextensions.targets.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.xaml.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.xaml.targets.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel.mof to %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel.mof.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel.mof.uninstall to %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel.mof.uninstall.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel35.mof to %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel35.mof.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel35.mof.uninstall to %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel35.mof.uninstall.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild\microsoft.build.commontypes.xsd to %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild\microsoft.build.commontypes.xsd.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild\microsoft.build.core.xsd to %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild\microsoft.build.core.xsd.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.rsp to %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.rsp.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.netframework.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.netframework.targets.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.servicemodel.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.servicemodel.targets.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\installpersistsqlstate.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installpersistsqlstate.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\installcommon.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installcommon.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\mscorlib.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\mscorlib.tlb.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\clr-etw.man to %WINDIR%\microsoft.net\framework\v4.0.30319\clr-etw.man.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\blackberry.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\blackberry.browser.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\chrome.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\chrome.browser.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\default.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\default.browser.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\firefox.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\firefox.browser.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\gateway.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\gateway.browser.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\generic.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\generic.browser.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\ie.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\ie.browser.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\iemobile.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\iemobile.browser.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\iphone.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\iphone.browser.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\opera.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\opera.browser.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\safari.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\safari.browser.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\ucbrowser.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\ucbrowser.browser.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\defaultwsdlhelpgenerator.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\config\defaultwsdlhelpgenerator.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\netfx40_iis_schema_update.xml to %WINDIR%\microsoft.net\framework\v4.0.30319\config\netfx40_iis_schema_update.xml.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\netfx45_iis_schema_update.xml to %WINDIR%\microsoft.net\framework\v4.0.30319\config\netfx45_iis_schema_update.xml.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\corperfmonsymbols.h to %WINDIR%\microsoft.net\framework\v4.0.30319\corperfmonsymbols.h.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\corperfmonsymbols.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\corperfmonsymbols.ini.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\csc.rsp to %WINDIR%\microsoft.net\framework\v4.0.30319\csc.rsp.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\default.win32manifest to %WINDIR%\microsoft.net\framework\v4.0.30319\default.win32manifest.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\dv_aspnetmmc.chm to %WINDIR%\microsoft.net\framework\v4.0.30319\dv_aspnetmmc.chm.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\microsoft.windows.applicationserver.applications.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\microsoft.windows.applicationserver.applications.dll.mui.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelevents.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelevents.dll.mui.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelinstallrc.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelinstallrc.dll.mui.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelperformancecounters.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelperformancecounters.dll.mui.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelregui.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelregui.dll.mui.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\workflowservicehostperformancecounters.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\workflowservicehostperformancecounters.dll.mui.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\mscoree.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\mscoree.tlb.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_state_perf.h to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_state_perf.h.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\installmembership.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installmembership.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\manageusers.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\manageusers.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\netmemorycache.h to %WINDIR%\microsoft.net\framework\v4.0.30319\netmemorycache.h.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallpersonalization.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallpersonalization.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallprofile.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallprofile.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallroles.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallroles.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallsqlstate.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallsqlstate.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallsqlstatetemplate.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallsqlstatetemplate.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallwebeventsqlprovider.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallwebeventsqlprovider.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\vbc.rsp to %WINDIR%\microsoft.net\framework\v4.0.30319\vbc.rsp.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\workflow.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\workflow.targets.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\workflow.visualbasic.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\workflow.visualbasic.targets.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\workflowservicehostperformancecounters.man to %WINDIR%\microsoft.net\framework\v4.0.30319\workflowservicehostperformancecounters.man.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\en-us\presentationhost_v0400.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\en-us\presentationhost_v0400.dll.mui.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globalmonospace.compositefont to %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globalmonospace.compositefont.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globalsansserif.compositefont to %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globalsansserif.compositefont.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globalserif.compositefont to %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globalserif.compositefont.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globaluserinterface.compositefont to %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globaluserinterface.compositefont.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\wpf-etw.man to %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\wpf-etw.man.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\xpthemes.manifest to %WINDIR%\microsoft.net\framework\v4.0.30319\xpthemes.manifest.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\_dataoracleclientperfcounters_shared12_neutral.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_dataoracleclientperfcounters_shared12_neutral.h.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\_dataoracleclientperfcounters_shared12_neutral.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_dataoracleclientperfcounters_shared12_neutral.ini.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters.h.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters.ini.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters_shared12_neutral.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters_shared12_neutral.h.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters_shared12_neutral.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters_shared12_neutral.ini.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters.h.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters.ini.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters_v2.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters_v2.h.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters_v2.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters_v2.ini.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\_smsvchostperfcounters.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_smsvchostperfcounters.h.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\_smsvchostperfcounters.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_smsvchostperfcounters.ini.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallpersistsqlstate.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallpersistsqlstate.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_perf2.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_perf2.ini.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_state_perf.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_state_perf.ini.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\thirdpartynotices.txt to %WINDIR%\microsoft.net\framework\v4.0.30319\thirdpartynotices.txt.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\ngen.log to %WINDIR%\microsoft.net\framework\v4.0.30319\ngen.log.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\ngen_service.log to %WINDIR%\microsoft.net\framework\v4.0.30319\ngen_service.log.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\normidna.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\normidna.nlp.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\normnfc.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\normnfc.nlp.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\normnfd.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\normnfd.nlp.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\normnfkc.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\normnfkc.nlp.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\normnfkd.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\normnfkd.nlp.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\perfcounters.h to %WINDIR%\microsoft.net\framework\v4.0.30319\perfcounters.h.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\perfcounters.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\perfcounters.ini.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\servicemodelperformancecounters.man to %WINDIR%\microsoft.net\framework\v4.0.30319\servicemodelperformancecounters.man.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\sortdefault.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\sortdefault.nlp.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlpersistenceproviderlogic.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlpersistenceproviderlogic.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlpersistenceproviderschema.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlpersistenceproviderschema.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlworkflowinstancestorelogic.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlworkflowinstancestorelogic.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlworkflowinstancestoreschema.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlworkflowinstancestoreschema.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceproviderlogic.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceproviderlogic.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceproviderschema.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceproviderschema.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceservice_logic.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceservice_logic.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceservice_schema.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceservice_schema.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestorelogic.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestorelogic.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestoreschema.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestoreschema.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestoreschemaupgrade.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestoreschemaupgrade.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\tracking_logic.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\tracking_logic.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\tracking_schema.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\tracking_schema.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\system.drawing.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\system.drawing.tlb.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\system.enterpriseservices.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\system.enterpriseservices.tlb.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\system.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\system.tlb.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\system.web.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\system.web.tlb.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\system.windows.forms.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\system.windows.forms.tlb.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallcommon.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallcommon.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\netmemorycache.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\netmemorycache.ini.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_perf.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_perf.ini.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_perf.h to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_perf.h.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet.mof.uninstall to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet.mof.uninstall.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_internals.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_internals.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_provider.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_provider.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_security.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_security.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\default.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\default.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\error.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\error.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home0.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home0.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home1.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home1.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home2.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home2.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\alert_lrg.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\alert_lrg.gif.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\aspdotnet_logo.jpg to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\aspdotnet_logo.jpg.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\aspx_file.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\aspx_file.gif.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\branding_full2.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\branding_full2.gif.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\darkblue_grad.jpg to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\darkblue_grad.jpg.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\deselectedtab_1x1.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\deselectedtab_1x1.gif.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\folder.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\folder.gif.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\gradient_onblue.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\gradient_onblue.gif.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\gradient_onwhite.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\gradient_onwhite.gif.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\headergradient_tall.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\headergradient_tall.gif.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\help.jpg to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\help.jpg.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\helpicon_solid.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\helpicon_solid.gif.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\image1.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\image1.gif.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\image2.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\image2.gif.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\requiredbang.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\requiredbang.gif.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\security_watermark.jpg to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\security_watermark.jpg.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_1x1.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_1x1.gif.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_leftcorner.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_leftcorner.gif.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_rightcorner.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_rightcorner.gif.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\navigationbar.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\navigationbar.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\home1.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\home1.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_application.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_application.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\_transactionbridgeperfcounters.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_transactionbridgeperfcounters.h.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\topgradrepeat.jpg to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\topgradrepeat.jpg.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\home0.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\home0.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\appconfighome.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\appconfighome.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\appsetting.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\appsetting.ascx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\appconfighome.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\appconfighome.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\appsetting.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\appsetting.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\createappsetting.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\createappsetting.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\debugandtrace.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\debugandtrace.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\defineerrorpage.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\defineerrorpage.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\editappsetting.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\editappsetting.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\manageappsettings.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\manageappsettings.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\smtpsettings.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\smtpsettings.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\createappsetting.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\createappsetting.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\debugandtrace.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\debugandtrace.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\defineerrorpage.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\defineerrorpage.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\adonetdiag.mof.uninstall to %WINDIR%\microsoft.net\framework\v4.0.30319\adonetdiag.mof.uninstall.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\editappsetting.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\editappsetting.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\smtpsettings.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\smtpsettings.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\applicationconfigurationpage.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\applicationconfigurationpage.cs.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\navigationbar.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\navigationbar.cs.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\passwordvaluetextbox.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\passwordvaluetextbox.cs.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\providerspage.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\providerspage.cs.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\securitypage.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\securitypage.cs.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\webadminpage.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\webadminpage.cs.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\wizardpage.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\wizardpage.cs.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_data\groupedproviders.xml to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_data\groupedproviders.xml.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_globalresources\appconfigcommon.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_globalresources\appconfigcommon.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_globalresources\globalresources.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_globalresources\globalresources.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\default.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\default.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\error.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\error.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\manageappsettings.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\manageappsettings.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\home2.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\home2.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallmembership.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallmembership.sql.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_leftcorner.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_leftcorner.gif.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\navigationbar.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\navigationbar.ascx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardauthentication.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardauthentication.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardcreateroles.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardcreateroles.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardfinish.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardfinish.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardinit.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardinit.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardpermission.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardpermission.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardproviderinfo.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardproviderinfo.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\confirmation.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\confirmation.ascx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizard.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizard.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardadduser.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardadduser.ascx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardauthentication.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardauthentication.ascx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardcreateroles.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardcreateroles.ascx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardfinish.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardfinish.ascx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardinit.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardinit.ascx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardpermission.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardpermission.ascx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardproviderinfo.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardproviderinfo.ascx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadmin.master to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadmin.master.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminbuttonrow.master to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminbuttonrow.master.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_application.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_application.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_internals.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_internals.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_provider.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_provider.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_security.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_security.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminnobuttonrow.master to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminnobuttonrow.master.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminnonavbar.master to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminnonavbar.master.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminstyles.css to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminstyles.css.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminwithconfirmation.master to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminwithconfirmation.master.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminwithconfirmationnobuttonrow.master to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminwithconfirmationnobuttonrow.master.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet.mof to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet.mof.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_rightcorner.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_rightcorner.gif.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardadduser.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardadduser.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\yellowcorner.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\yellowcorner.gif.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizard.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizard.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\chooseprovidermanagement.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\chooseprovidermanagement.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\manageconsolidatedproviders.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\manageconsolidatedproviders.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\manageproviders.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\manageproviders.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\providerlist.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\providerlist.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\chooseprovidermanagement.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\chooseprovidermanagement.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\manageconsolidatedproviders.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\manageconsolidatedproviders.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\manageproviders.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\manageproviders.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\providerlist.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\providerlist.ascx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\security.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\security.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\security0.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\security0.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\setupauthentication.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\setupauthentication.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\app_localresources\createpermission.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\app_localresources\createpermission.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\app_localresources\managepermissions.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\app_localresources\managepermissions.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\createpermission.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\createpermission.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\managepermissions.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\managepermissions.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\app_localresources\manageallroles.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\app_localresources\manageallroles.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\app_localresources\managesinglerole.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\app_localresources\managesinglerole.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\manageallroles.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\manageallroles.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\managesinglerole.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\managesinglerole.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\security.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\security.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\security0.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\security0.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\setupauthentication.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\setupauthentication.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\adduser.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\adduser.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\adduser.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\adduser.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\edituser.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\edituser.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\findusers.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\findusers.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\manageusers.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\manageusers.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\edituser.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\edituser.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\findusers.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\findusers.aspx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\confirmation.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\confirmation.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
from %WINDIR%\microsoft.net\framework\v4.0.30319\_transactionbridgeperfcounters.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_transactionbridgeperfcounters.ini.[396b1028].[killyouass@protonmail.com].makop

Modifies user data files (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' ' (with hidden window)

Executes the following

'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe'
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' n1924
'<SYSTEM32>\cmd.exe'
'<SYSTEM32>\vssvc.exe'
'<SYSTEM32>\svchost.exe' -k swprv
'<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\wbadmin.exe' delete catalog -quiet
'<SYSTEM32>\wbengine.exe'
'<SYSTEM32>\vds.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней