PER UTENTI

Chiudi

La mia libreria
La mia libreria

+ Aggiungi alla libreria

Ricerca
Ricerca

Supporto
Supporto 24/7 | Regole per contattare

Scrivi

Una richiesta attraverso il modulo

Chiama

+7 (495) 789-45-86

Forum

Richieste

Crea nuova richiesta

Chiama

+7 (495) 789-45-86

Profile

IT

RU CN DE EN ES FR IT JP KZ UZ PL BY
Chiudi
Servizi
Scanner
Dr.Web vxCube
Versione di prova
Perizia di incidenti informatici legati ai virus
Libreria dei virus
Base di conoscenza

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Notizie

Trojan.Encoder.31698

Aggiunto al database dei virus Dr.Web: 2020-04-30

La descrizione è stata aggiunta:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1' = '"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"'
Changes the following executable system files
  • %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\microsoft.windows.applicationserver.applications.dll.mui
  • %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelevents.dll.mui
  • %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelinstallrc.dll.mui
  • %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelperformancecounters.dll.mui
  • %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelregui.dll.mui
  • %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\workflowservicehostperformancecounters.dll.mui
  • %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.jscript.tlb
  • %WINDIR%\microsoft.net\framework\v4.0.30319\mscoree.tlb
  • %WINDIR%\microsoft.net\framework\v4.0.30319\mscorlib.tlb
  • %WINDIR%\microsoft.net\framework\v4.0.30319\system.drawing.tlb
  • %WINDIR%\microsoft.net\framework\v4.0.30319\system.enterpriseservices.tlb
  • %WINDIR%\microsoft.net\framework\v4.0.30319\system.tlb
  • %WINDIR%\microsoft.net\framework\v4.0.30319\system.web.tlb
  • %WINDIR%\microsoft.net\framework\v4.0.30319\system.windows.forms.tlb
  • %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\en-us\presentationhost_v0400.dll.mui
Creates the following files on removable media
  • <Drive name for removable media>:\split.avi
  • <Drive name for removable media>:\advice_process.htm
  • <Drive name for removable media>:\ituneshelpunavailable.htm
  • <Drive name for removable media>:\tree_view.htm
  • <Drive name for removable media>:\thlps_keeper_mayer_1965.docx
  • <Drive name for removable media>:\file_p_00000000_1371597592.docx
  • <Drive name for removable media>:\sdszfo.docx
  • <Drive name for removable media>:\contoso.cer
  • <Drive name for removable media>:\sdkfailsafeemulator.cer
  • <Drive name for removable media>:\tileimage.bmp
  • <Drive name for removable media>:\toolbar.bmp
  • <Drive name for removable media>:\dial.bmp
  • <Drive name for removable media>:\dashborder_144.bmp
  • <Drive name for removable media>:\dashborder_96.bmp
  • <Drive name for removable media>:\dialmap.bmp
  • <Drive name for removable media>:\delete.avi
  • <Drive name for removable media>:\garden.htm
  • <Drive name for removable media>:\about.html
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
  • System Restore (SR)
deletes volume shadow copies.
Injects code into
the following system processes:
  • %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
  • <SYSTEM32>\vssvc.exe
  • <SYSTEM32>\wbengine.exe
  • <SYSTEM32>\vds.exe
Modifies file system
Creates the following files
  • %WINDIR%\logs\windowsbackup\wbadmin.0.etl
Moves the following system files
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\adonetdiag.mof to %WINDIR%\microsoft.net\framework\v4.0.30319\adonetdiag.mof.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\installroles.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installroles.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\installsqlstate.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installsqlstate.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\installsqlstatetemplate.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installsqlstatetemplate.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\installwebeventsqlprovider.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installwebeventsqlprovider.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\locale.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\locale.nlp.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.build.xsd to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.build.xsd.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.common.overridetasks to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.common.overridetasks.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.common.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.common.targets.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.common.tasks to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.common.tasks.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.csharp.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.csharp.targets.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.data.entity.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.data.entity.targets.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.jscript.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.jscript.tlb.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\installpersonalization.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installpersonalization.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\installprofile.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installprofile.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.netframework.props to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.netframework.props.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.visualbasic.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.visualbasic.targets.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.windows.applicationserver.applications.45.man to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.windows.applicationserver.applications.45.man.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.winfx.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.winfx.targets.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.workflowbuildextensions.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.workflowbuildextensions.targets.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.xaml.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.xaml.targets.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel.mof to %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel.mof.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel.mof.uninstall to %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel.mof.uninstall.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel35.mof to %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel35.mof.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel35.mof.uninstall to %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel35.mof.uninstall.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild\microsoft.build.commontypes.xsd to %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild\microsoft.build.commontypes.xsd.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild\microsoft.build.core.xsd to %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild\microsoft.build.core.xsd.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.rsp to %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.rsp.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.netframework.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.netframework.targets.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.servicemodel.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.servicemodel.targets.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\installpersistsqlstate.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installpersistsqlstate.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\installcommon.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installcommon.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\mscorlib.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\mscorlib.tlb.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\clr-etw.man to %WINDIR%\microsoft.net\framework\v4.0.30319\clr-etw.man.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\blackberry.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\blackberry.browser.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\chrome.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\chrome.browser.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\default.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\default.browser.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\firefox.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\firefox.browser.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\gateway.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\gateway.browser.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\generic.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\generic.browser.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\ie.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\ie.browser.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\iemobile.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\iemobile.browser.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\iphone.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\iphone.browser.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\opera.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\opera.browser.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\safari.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\safari.browser.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\ucbrowser.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\ucbrowser.browser.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\config\defaultwsdlhelpgenerator.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\config\defaultwsdlhelpgenerator.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\config\netfx40_iis_schema_update.xml to %WINDIR%\microsoft.net\framework\v4.0.30319\config\netfx40_iis_schema_update.xml.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\config\netfx45_iis_schema_update.xml to %WINDIR%\microsoft.net\framework\v4.0.30319\config\netfx45_iis_schema_update.xml.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\corperfmonsymbols.h to %WINDIR%\microsoft.net\framework\v4.0.30319\corperfmonsymbols.h.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\corperfmonsymbols.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\corperfmonsymbols.ini.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\csc.rsp to %WINDIR%\microsoft.net\framework\v4.0.30319\csc.rsp.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\default.win32manifest to %WINDIR%\microsoft.net\framework\v4.0.30319\default.win32manifest.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\dv_aspnetmmc.chm to %WINDIR%\microsoft.net\framework\v4.0.30319\dv_aspnetmmc.chm.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\microsoft.windows.applicationserver.applications.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\microsoft.windows.applicationserver.applications.dll.mui.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelevents.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelevents.dll.mui.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelinstallrc.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelinstallrc.dll.mui.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelperformancecounters.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelperformancecounters.dll.mui.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelregui.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelregui.dll.mui.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\workflowservicehostperformancecounters.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\workflowservicehostperformancecounters.dll.mui.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\mscoree.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\mscoree.tlb.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_state_perf.h to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_state_perf.h.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\installmembership.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installmembership.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\manageusers.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\manageusers.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\netmemorycache.h to %WINDIR%\microsoft.net\framework\v4.0.30319\netmemorycache.h.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallpersonalization.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallpersonalization.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallprofile.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallprofile.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallroles.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallroles.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallsqlstate.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallsqlstate.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallsqlstatetemplate.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallsqlstatetemplate.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallwebeventsqlprovider.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallwebeventsqlprovider.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\vbc.rsp to %WINDIR%\microsoft.net\framework\v4.0.30319\vbc.rsp.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\workflow.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\workflow.targets.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\workflow.visualbasic.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\workflow.visualbasic.targets.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\workflowservicehostperformancecounters.man to %WINDIR%\microsoft.net\framework\v4.0.30319\workflowservicehostperformancecounters.man.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\en-us\presentationhost_v0400.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\en-us\presentationhost_v0400.dll.mui.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globalmonospace.compositefont to %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globalmonospace.compositefont.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globalsansserif.compositefont to %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globalsansserif.compositefont.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globalserif.compositefont to %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globalserif.compositefont.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globaluserinterface.compositefont to %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globaluserinterface.compositefont.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\wpf-etw.man to %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\wpf-etw.man.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\xpthemes.manifest to %WINDIR%\microsoft.net\framework\v4.0.30319\xpthemes.manifest.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\_dataoracleclientperfcounters_shared12_neutral.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_dataoracleclientperfcounters_shared12_neutral.h.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\_dataoracleclientperfcounters_shared12_neutral.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_dataoracleclientperfcounters_shared12_neutral.ini.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters.h.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters.ini.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters_shared12_neutral.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters_shared12_neutral.h.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters_shared12_neutral.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters_shared12_neutral.ini.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters.h.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters.ini.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters_v2.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters_v2.h.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters_v2.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters_v2.ini.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\_smsvchostperfcounters.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_smsvchostperfcounters.h.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\_smsvchostperfcounters.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_smsvchostperfcounters.ini.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallpersistsqlstate.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallpersistsqlstate.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_perf2.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_perf2.ini.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_state_perf.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_state_perf.ini.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\thirdpartynotices.txt to %WINDIR%\microsoft.net\framework\v4.0.30319\thirdpartynotices.txt.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\ngen.log to %WINDIR%\microsoft.net\framework\v4.0.30319\ngen.log.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\ngen_service.log to %WINDIR%\microsoft.net\framework\v4.0.30319\ngen_service.log.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\normidna.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\normidna.nlp.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\normnfc.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\normnfc.nlp.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\normnfd.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\normnfd.nlp.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\normnfkc.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\normnfkc.nlp.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\normnfkd.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\normnfkd.nlp.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\perfcounters.h to %WINDIR%\microsoft.net\framework\v4.0.30319\perfcounters.h.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\perfcounters.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\perfcounters.ini.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\servicemodelperformancecounters.man to %WINDIR%\microsoft.net\framework\v4.0.30319\servicemodelperformancecounters.man.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\sortdefault.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\sortdefault.nlp.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlpersistenceproviderlogic.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlpersistenceproviderlogic.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlpersistenceproviderschema.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlpersistenceproviderschema.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlworkflowinstancestorelogic.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlworkflowinstancestorelogic.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlworkflowinstancestoreschema.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlworkflowinstancestoreschema.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceproviderlogic.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceproviderlogic.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceproviderschema.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceproviderschema.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceservice_logic.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceservice_logic.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceservice_schema.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceservice_schema.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestorelogic.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestorelogic.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestoreschema.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestoreschema.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestoreschemaupgrade.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestoreschemaupgrade.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\tracking_logic.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\tracking_logic.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\tracking_schema.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\tracking_schema.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\system.drawing.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\system.drawing.tlb.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\system.enterpriseservices.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\system.enterpriseservices.tlb.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\system.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\system.tlb.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\system.web.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\system.web.tlb.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\system.windows.forms.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\system.windows.forms.tlb.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallcommon.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallcommon.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\netmemorycache.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\netmemorycache.ini.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_perf.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_perf.ini.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_perf.h to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_perf.h.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet.mof.uninstall to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet.mof.uninstall.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_internals.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_internals.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_provider.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_provider.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_security.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_security.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\default.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\default.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\error.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\error.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home0.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home0.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home1.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home1.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home2.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home2.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\alert_lrg.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\alert_lrg.gif.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\aspdotnet_logo.jpg to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\aspdotnet_logo.jpg.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\aspx_file.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\aspx_file.gif.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\branding_full2.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\branding_full2.gif.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\darkblue_grad.jpg to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\darkblue_grad.jpg.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\deselectedtab_1x1.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\deselectedtab_1x1.gif.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\folder.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\folder.gif.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\gradient_onblue.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\gradient_onblue.gif.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\gradient_onwhite.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\gradient_onwhite.gif.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\headergradient_tall.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\headergradient_tall.gif.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\help.jpg to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\help.jpg.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\helpicon_solid.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\helpicon_solid.gif.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\image1.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\image1.gif.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\image2.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\image2.gif.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\requiredbang.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\requiredbang.gif.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\security_watermark.jpg to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\security_watermark.jpg.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_1x1.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_1x1.gif.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_leftcorner.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_leftcorner.gif.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_rightcorner.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_rightcorner.gif.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\navigationbar.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\navigationbar.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\home1.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\home1.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_application.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_application.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\_transactionbridgeperfcounters.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_transactionbridgeperfcounters.h.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\topgradrepeat.jpg to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\topgradrepeat.jpg.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\home0.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\home0.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\appconfighome.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\appconfighome.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\appsetting.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\appsetting.ascx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\appconfighome.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\appconfighome.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\appsetting.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\appsetting.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\createappsetting.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\createappsetting.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\debugandtrace.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\debugandtrace.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\defineerrorpage.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\defineerrorpage.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\editappsetting.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\editappsetting.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\manageappsettings.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\manageappsettings.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\smtpsettings.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\smtpsettings.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\createappsetting.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\createappsetting.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\debugandtrace.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\debugandtrace.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\defineerrorpage.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\defineerrorpage.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\adonetdiag.mof.uninstall to %WINDIR%\microsoft.net\framework\v4.0.30319\adonetdiag.mof.uninstall.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\editappsetting.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\editappsetting.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\smtpsettings.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\smtpsettings.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\applicationconfigurationpage.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\applicationconfigurationpage.cs.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\navigationbar.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\navigationbar.cs.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\passwordvaluetextbox.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\passwordvaluetextbox.cs.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\providerspage.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\providerspage.cs.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\securitypage.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\securitypage.cs.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\webadminpage.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\webadminpage.cs.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\wizardpage.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\wizardpage.cs.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_data\groupedproviders.xml to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_data\groupedproviders.xml.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_globalresources\appconfigcommon.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_globalresources\appconfigcommon.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_globalresources\globalresources.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_globalresources\globalresources.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\default.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\default.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\error.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\error.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\manageappsettings.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\manageappsettings.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\home2.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\home2.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallmembership.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallmembership.sql.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_leftcorner.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_leftcorner.gif.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\navigationbar.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\navigationbar.ascx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardauthentication.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardauthentication.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardcreateroles.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardcreateroles.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardfinish.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardfinish.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardinit.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardinit.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardpermission.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardpermission.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardproviderinfo.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardproviderinfo.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\confirmation.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\confirmation.ascx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizard.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizard.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardadduser.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardadduser.ascx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardauthentication.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardauthentication.ascx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardcreateroles.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardcreateroles.ascx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardfinish.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardfinish.ascx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardinit.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardinit.ascx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardpermission.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardpermission.ascx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardproviderinfo.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardproviderinfo.ascx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadmin.master to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadmin.master.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminbuttonrow.master to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminbuttonrow.master.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_application.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_application.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_internals.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_internals.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_provider.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_provider.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_security.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_security.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminnobuttonrow.master to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminnobuttonrow.master.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminnonavbar.master to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminnonavbar.master.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminstyles.css to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminstyles.css.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminwithconfirmation.master to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminwithconfirmation.master.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminwithconfirmationnobuttonrow.master to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminwithconfirmationnobuttonrow.master.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet.mof to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet.mof.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_rightcorner.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_rightcorner.gif.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardadduser.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardadduser.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\yellowcorner.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\yellowcorner.gif.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizard.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizard.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\chooseprovidermanagement.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\chooseprovidermanagement.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\manageconsolidatedproviders.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\manageconsolidatedproviders.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\manageproviders.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\manageproviders.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\providerlist.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\providerlist.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\chooseprovidermanagement.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\chooseprovidermanagement.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\manageconsolidatedproviders.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\manageconsolidatedproviders.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\manageproviders.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\manageproviders.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\providerlist.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\providerlist.ascx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\security.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\security.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\security0.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\security0.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\setupauthentication.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\setupauthentication.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\app_localresources\createpermission.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\app_localresources\createpermission.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\app_localresources\managepermissions.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\app_localresources\managepermissions.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\createpermission.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\createpermission.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\managepermissions.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\managepermissions.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\app_localresources\manageallroles.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\app_localresources\manageallroles.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\app_localresources\managesinglerole.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\app_localresources\managesinglerole.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\manageallroles.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\manageallroles.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\managesinglerole.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\managesinglerole.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\security.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\security.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\security0.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\security0.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\setupauthentication.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\setupauthentication.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\adduser.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\adduser.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\adduser.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\adduser.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\edituser.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\edituser.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\findusers.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\findusers.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\manageusers.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\manageusers.aspx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\edituser.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\edituser.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\findusers.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\findusers.aspx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\confirmation.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\confirmation.ascx.resx.[396b1028].[killyouass@protonmail.com].makop
  • from %WINDIR%\microsoft.net\framework\v4.0.30319\_transactionbridgeperfcounters.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_transactionbridgeperfcounters.ini.[396b1028].[killyouass@protonmail.com].makop
Modifies user data files (Trojan.Encoder).
Miscellaneous
Creates and executes the following
  • '<SYSTEM32>\cmd.exe' ' (with hidden window)
Executes the following
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe'
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' n1924
  • '<SYSTEM32>\cmd.exe'
  • '<SYSTEM32>\vssvc.exe'
  • '<SYSTEM32>\svchost.exe' -k swprv
  • '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
  • '<SYSTEM32>\wbadmin.exe' delete catalog -quiet
  • '<SYSTEM32>\wbengine.exe'
  • '<SYSTEM32>\vds.exe'

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

 

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

 

Download Dr.Web

Download by serial number

Download on App Store

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

 

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play