Trojan.Encoder.35671

Technical Information

To ensure autorun and distribution

Changes the following executable system files

%WINDIR%\microsoft.net\framework\v4.0.30319\en-us\microsoft.windows.applicationserver.applications.dll.mui
%WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelevents.dll.mui
%WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelinstallrc.dll.mui
%WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelperformancecounters.dll.mui
%WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelregui.dll.mui
%WINDIR%\microsoft.net\framework\v4.0.30319\en-us\workflowservicehostperformancecounters.dll.mui
%WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.jscript.tlb
%WINDIR%\microsoft.net\framework\v4.0.30319\mscoree.tlb
%WINDIR%\microsoft.net\framework\v4.0.30319\mscorlib.tlb
%WINDIR%\microsoft.net\framework\v4.0.30319\system.drawing.tlb
%WINDIR%\microsoft.net\framework\v4.0.30319\system.enterpriseservices.tlb
%WINDIR%\microsoft.net\framework\v4.0.30319\system.tlb
%WINDIR%\microsoft.net\framework\v4.0.30319\system.web.tlb
%WINDIR%\microsoft.net\framework\v4.0.30319\system.windows.forms.tlb
%WINDIR%\microsoft.net\framework\v4.0.30319\wpf\en-us\presentationhost_v0400.dll.mui

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Injects code into

the following system processes:

<SYSTEM32>\vds.exe

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\taskhost.exe
<SYSTEM32>\dwm.exe
<SYSTEM32>\vds.exe

Modifies file system

Creates the following files

%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\+readme-warning+.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\+readme-warning+.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\+readme-warning+.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\+readme-warning+.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\+readme-warning+.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\+readme-warning+.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\+readme-warning+.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\+readme-warning+.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\+readme-warning+.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\+readme-warning+.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\+readme-warning+.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\+readme-warning+.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\+readme-warning+.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\+readme-warning+.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\+readme-warning+.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\+readme-warning+.txt
C:\far2\+readme-warning+.txt
C:\far2\pluginsdk\headers.pas\+readme-warning+.txt
C:\far2\pluginsdk\headers.c\+readme-warning+.txt
C:\far2\plugins\tmppanel\+readme-warning+.txt
C:\far2\plugins\proclist\+readme-warning+.txt
C:\far2\plugins\network\+readme-warning+.txt
C:\far2\plugins\macroview\+readme-warning+.txt
C:\far2\plugins\hlfviewer\+readme-warning+.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\+readme-warning+.txt
C:\far2\documentation\eng\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\equation\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\smart tag\1033\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\proof\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\+readme-warning+.txt
C:\far2\plugins\ftp\+readme-warning+.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\1033\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\grphflt\+readme-warning+.txt
C:\far2\plugins\ftp\lib\+readme-warning+.txt
C:\far2\plugins\filecase\+readme-warning+.txt
C:\far2\plugins\farcmds\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\app_localresources\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\mof\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\en-us\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\config\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\smart tag\lists\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\app_localresources\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_globalresources\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_data\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\wpf\en-us\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\+readme-warning+.txt
C:\far2\plugins\emenu\+readme-warning+.txt
C:\far2\plugins\editcase\+readme-warning+.txt
C:\far2\plugins\drawline\+readme-warning+.txt
C:\far2\plugins\compare\+readme-warning+.txt
C:\far2\plugins\brackets\+readme-warning+.txt
C:\far2\plugins\autowrap\+readme-warning+.txt
C:\far2\plugins\arclite\+readme-warning+.txt
C:\far2\plugins\align\+readme-warning+.txt
C:\far2\fexcept\+readme-warning+.txt
C:\far2\encyclopedia\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\wpf\+readme-warning+.txt
C:\far2\encyclopedia\tap\+readme-warning+.txt
%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild\+readme-warning+.txt
C:\far2\addons\+readme-warning+.txt
C:\far2\addons\xlat\+readme-warning+.txt
C:\far2\addons\xlat\russian\+readme-warning+.txt
C:\far2\addons\shell\+readme-warning+.txt
C:\far2\addons\setup\+readme-warning+.txt
C:\far2\addons\macros\+readme-warning+.txt
C:\far2\addons\colors\+readme-warning+.txt
C:\far2\addons\colors\default_highlighting\+readme-warning+.txt
C:\far2\addons\colors\custom_highlighting\+readme-warning+.txt
D:\+readme-warning+.txt
C:\far2\documentation\rus\+readme-warning+.txt
%CommonProgramFiles%\microsoft shared\smart tag\+readme-warning+.txt

Moves the following system files

from %WINDIR%\microsoft.net\framework\v4.0.30319\adonetdiag.mof to %WINDIR%\microsoft.net\framework\v4.0.30319\adonetdiag.mof.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\installroles.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installroles.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\installsqlstate.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installsqlstate.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\installsqlstatetemplate.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installsqlstatetemplate.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\installwebeventsqlprovider.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installwebeventsqlprovider.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\locale.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\locale.nlp.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.build.xsd to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.build.xsd.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.common.overridetasks to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.common.overridetasks.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.common.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.common.targets.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.common.tasks to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.common.tasks.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.csharp.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.csharp.targets.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.data.entity.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.data.entity.targets.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.jscript.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.jscript.tlb.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\installpersonalization.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installpersonalization.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\installprofile.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installprofile.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.netframework.props to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.netframework.props.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.visualbasic.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.visualbasic.targets.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.windows.applicationserver.applications.45.man to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.windows.applicationserver.applications.45.man.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.winfx.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.winfx.targets.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.workflowbuildextensions.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.workflowbuildextensions.targets.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.xaml.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.xaml.targets.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel.mof to %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel.mof.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel.mof.uninstall to %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel.mof.uninstall.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel35.mof to %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel35.mof.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel35.mof.uninstall to %WINDIR%\microsoft.net\framework\v4.0.30319\mof\servicemodel35.mof.uninstall.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild\microsoft.build.commontypes.xsd to %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild\microsoft.build.commontypes.xsd.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild\microsoft.build.core.xsd to %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild\microsoft.build.core.xsd.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.rsp to %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.rsp.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.netframework.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.netframework.targets.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.servicemodel.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.servicemodel.targets.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\installpersistsqlstate.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installpersistsqlstate.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\installcommon.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installcommon.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\mscorlib.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\mscorlib.tlb.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\clr-etw.man to %WINDIR%\microsoft.net\framework\v4.0.30319\clr-etw.man.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\blackberry.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\blackberry.browser.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\chrome.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\chrome.browser.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\default.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\default.browser.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\firefox.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\firefox.browser.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\gateway.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\gateway.browser.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\generic.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\generic.browser.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\ie.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\ie.browser.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\iemobile.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\iemobile.browser.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\iphone.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\iphone.browser.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\opera.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\opera.browser.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\safari.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\safari.browser.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\ucbrowser.browser to %WINDIR%\microsoft.net\framework\v4.0.30319\config\browsers\ucbrowser.browser.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\defaultwsdlhelpgenerator.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\config\defaultwsdlhelpgenerator.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\netfx40_iis_schema_update.xml to %WINDIR%\microsoft.net\framework\v4.0.30319\config\netfx40_iis_schema_update.xml.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\config\netfx45_iis_schema_update.xml to %WINDIR%\microsoft.net\framework\v4.0.30319\config\netfx45_iis_schema_update.xml.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\corperfmonsymbols.h to %WINDIR%\microsoft.net\framework\v4.0.30319\corperfmonsymbols.h.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\corperfmonsymbols.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\corperfmonsymbols.ini.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\csc.rsp to %WINDIR%\microsoft.net\framework\v4.0.30319\csc.rsp.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\default.win32manifest to %WINDIR%\microsoft.net\framework\v4.0.30319\default.win32manifest.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\dv_aspnetmmc.chm to %WINDIR%\microsoft.net\framework\v4.0.30319\dv_aspnetmmc.chm.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\microsoft.windows.applicationserver.applications.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\microsoft.windows.applicationserver.applications.dll.mui.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelevents.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelevents.dll.mui.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelinstallrc.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelinstallrc.dll.mui.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelperformancecounters.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelperformancecounters.dll.mui.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelregui.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\servicemodelregui.dll.mui.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\workflowservicehostperformancecounters.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\en-us\workflowservicehostperformancecounters.dll.mui.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\mscoree.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\mscoree.tlb.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_state_perf.h to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_state_perf.h.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\installmembership.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\installmembership.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\manageusers.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\manageusers.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\netmemorycache.h to %WINDIR%\microsoft.net\framework\v4.0.30319\netmemorycache.h.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallpersonalization.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallpersonalization.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallprofile.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallprofile.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallroles.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallroles.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallsqlstate.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallsqlstate.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallsqlstatetemplate.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallsqlstatetemplate.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallwebeventsqlprovider.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallwebeventsqlprovider.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\vbc.rsp to %WINDIR%\microsoft.net\framework\v4.0.30319\vbc.rsp.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\workflow.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\workflow.targets.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\workflow.visualbasic.targets to %WINDIR%\microsoft.net\framework\v4.0.30319\workflow.visualbasic.targets.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\workflowservicehostperformancecounters.man to %WINDIR%\microsoft.net\framework\v4.0.30319\workflowservicehostperformancecounters.man.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\en-us\presentationhost_v0400.dll.mui to %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\en-us\presentationhost_v0400.dll.mui.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globalmonospace.compositefont to %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globalmonospace.compositefont.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globalsansserif.compositefont to %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globalsansserif.compositefont.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globalserif.compositefont to %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globalserif.compositefont.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globaluserinterface.compositefont to %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\fonts\globaluserinterface.compositefont.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\wpf-etw.man to %WINDIR%\microsoft.net\framework\v4.0.30319\wpf\wpf-etw.man.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\xpthemes.manifest to %WINDIR%\microsoft.net\framework\v4.0.30319\xpthemes.manifest.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\_dataoracleclientperfcounters_shared12_neutral.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_dataoracleclientperfcounters_shared12_neutral.h.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\_dataoracleclientperfcounters_shared12_neutral.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_dataoracleclientperfcounters_shared12_neutral.ini.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters.h.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters.ini.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters_shared12_neutral.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters_shared12_neutral.h.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters_shared12_neutral.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_dataperfcounters_shared12_neutral.ini.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters.h.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters.ini.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters_v2.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters_v2.h.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters_v2.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_networkingperfcounters_v2.ini.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\_smsvchostperfcounters.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_smsvchostperfcounters.h.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\_smsvchostperfcounters.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_smsvchostperfcounters.ini.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallpersistsqlstate.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallpersistsqlstate.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_perf2.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_perf2.ini.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_state_perf.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_state_perf.ini.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\thirdpartynotices.txt to %WINDIR%\microsoft.net\framework\v4.0.30319\thirdpartynotices.txt.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\ngen.log to %WINDIR%\microsoft.net\framework\v4.0.30319\ngen.log.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\ngen_service.log to %WINDIR%\microsoft.net\framework\v4.0.30319\ngen_service.log.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\normidna.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\normidna.nlp.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\normnfc.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\normnfc.nlp.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\normnfd.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\normnfd.nlp.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\normnfkc.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\normnfkc.nlp.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\normnfkd.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\normnfkd.nlp.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\perfcounters.h to %WINDIR%\microsoft.net\framework\v4.0.30319\perfcounters.h.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\perfcounters.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\perfcounters.ini.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\servicemodelperformancecounters.man to %WINDIR%\microsoft.net\framework\v4.0.30319\servicemodelperformancecounters.man.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\sortdefault.nlp to %WINDIR%\microsoft.net\framework\v4.0.30319\sortdefault.nlp.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlpersistenceproviderlogic.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlpersistenceproviderlogic.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlpersistenceproviderschema.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlpersistenceproviderschema.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlworkflowinstancestorelogic.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlworkflowinstancestorelogic.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlworkflowinstancestoreschema.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlworkflowinstancestoreschema.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceproviderlogic.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceproviderlogic.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceproviderschema.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceproviderschema.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceservice_logic.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceservice_logic.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceservice_schema.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceservice_schema.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestorelogic.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestorelogic.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestoreschema.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestoreschema.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestoreschemaupgrade.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestoreschemaupgrade.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\tracking_logic.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\tracking_logic.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\tracking_schema.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\tracking_schema.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\system.drawing.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\system.drawing.tlb.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\system.enterpriseservices.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\system.enterpriseservices.tlb.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\system.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\system.tlb.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\system.web.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\system.web.tlb.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\system.windows.forms.tlb to %WINDIR%\microsoft.net\framework\v4.0.30319\system.windows.forms.tlb.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallcommon.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallcommon.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\netmemorycache.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\netmemorycache.ini.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_perf.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_perf.ini.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_perf.h to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_perf.h.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet.mof.uninstall to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet.mof.uninstall.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_internals.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_internals.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_provider.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_provider.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_security.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_security.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\default.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\default.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\error.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\error.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home0.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home0.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home1.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home1.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home2.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\home2.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\alert_lrg.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\alert_lrg.gif.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\aspdotnet_logo.jpg to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\aspdotnet_logo.jpg.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\aspx_file.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\aspx_file.gif.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\branding_full2.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\branding_full2.gif.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\darkblue_grad.jpg to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\darkblue_grad.jpg.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\deselectedtab_1x1.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\deselectedtab_1x1.gif.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\folder.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\folder.gif.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\gradient_onblue.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\gradient_onblue.gif.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\gradient_onwhite.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\gradient_onwhite.gif.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\headergradient_tall.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\headergradient_tall.gif.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\help.jpg to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\help.jpg.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\helpicon_solid.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\helpicon_solid.gif.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\image1.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\image1.gif.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\image2.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\image2.gif.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\requiredbang.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\requiredbang.gif.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\security_watermark.jpg to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\security_watermark.jpg.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_1x1.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_1x1.gif.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_leftcorner.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_leftcorner.gif.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_rightcorner.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_rightcorner.gif.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\navigationbar.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\navigationbar.ascx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\home1.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\home1.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_application.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp_application.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\_transactionbridgeperfcounters.h to %WINDIR%\microsoft.net\framework\v4.0.30319\_transactionbridgeperfcounters.h.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\topgradrepeat.jpg to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\topgradrepeat.jpg.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\home0.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\home0.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\appconfighome.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\appconfighome.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\appsetting.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\appsetting.ascx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\appconfighome.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\appconfighome.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\appsetting.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\appsetting.ascx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\createappsetting.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\createappsetting.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\debugandtrace.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\debugandtrace.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\defineerrorpage.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\defineerrorpage.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\editappsetting.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\editappsetting.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\manageappsettings.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\manageappsettings.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\smtpsettings.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\smtpsettings.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\createappsetting.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\createappsetting.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\debugandtrace.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\debugandtrace.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\defineerrorpage.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\defineerrorpage.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\adonetdiag.mof.uninstall to %WINDIR%\microsoft.net\framework\v4.0.30319\adonetdiag.mof.uninstall.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\editappsetting.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\editappsetting.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\smtpsettings.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\smtpsettings.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\applicationconfigurationpage.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\applicationconfigurationpage.cs.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\navigationbar.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\navigationbar.cs.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\passwordvaluetextbox.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\passwordvaluetextbox.cs.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\providerspage.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\providerspage.cs.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\securitypage.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\securitypage.cs.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\webadminpage.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\webadminpage.cs.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\wizardpage.cs to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_code\wizardpage.cs.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_data\groupedproviders.xml to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_data\groupedproviders.xml.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_globalresources\appconfigcommon.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_globalresources\appconfigcommon.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_globalresources\globalresources.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_globalresources\globalresources.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\default.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\default.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\error.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\error.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\manageappsettings.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\manageappsettings.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\home2.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\home2.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallmembership.sql to %WINDIR%\microsoft.net\framework\v4.0.30319\uninstallmembership.sql.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_leftcorner.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_leftcorner.gif.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\navigationbar.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\navigationbar.ascx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardauthentication.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardauthentication.ascx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardcreateroles.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardcreateroles.ascx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardfinish.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardfinish.ascx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardinit.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardinit.ascx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardpermission.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardpermission.ascx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardproviderinfo.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardproviderinfo.ascx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\confirmation.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\confirmation.ascx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizard.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizard.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardadduser.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardadduser.ascx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardauthentication.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardauthentication.ascx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardcreateroles.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardcreateroles.ascx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardfinish.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardfinish.ascx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardinit.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardinit.ascx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardpermission.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardpermission.ascx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardproviderinfo.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardproviderinfo.ascx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadmin.master to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadmin.master.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminbuttonrow.master to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminbuttonrow.master.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_application.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_application.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_internals.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_internals.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_provider.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_provider.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_security.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_security.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminnobuttonrow.master to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminnobuttonrow.master.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminnonavbar.master to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminnonavbar.master.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminstyles.css to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminstyles.css.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminwithconfirmation.master to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminwithconfirmation.master.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminwithconfirmationnobuttonrow.master to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminwithconfirmationnobuttonrow.master.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet.mof to %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet.mof.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_rightcorner.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_rightcorner.gif.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardadduser.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardadduser.ascx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\yellowcorner.gif to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\yellowcorner.gif.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizard.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizard.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\app_localresources\webadminhelp.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\chooseprovidermanagement.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\chooseprovidermanagement.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\manageconsolidatedproviders.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\manageconsolidatedproviders.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\manageproviders.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\manageproviders.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\providerlist.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\providerlist.ascx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\chooseprovidermanagement.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\chooseprovidermanagement.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\manageconsolidatedproviders.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\manageconsolidatedproviders.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\manageproviders.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\manageproviders.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\providerlist.ascx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\providerlist.ascx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\security.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\security.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\security0.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\security0.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\setupauthentication.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\app_localresources\setupauthentication.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\app_localresources\createpermission.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\app_localresources\createpermission.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\app_localresources\managepermissions.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\app_localresources\managepermissions.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\createpermission.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\createpermission.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\managepermissions.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\managepermissions.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\app_localresources\manageallroles.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\app_localresources\manageallroles.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\app_localresources\managesinglerole.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\app_localresources\managesinglerole.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\manageallroles.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\manageallroles.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\managesinglerole.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\roles\managesinglerole.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\security.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\security.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\security0.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\security0.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\setupauthentication.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\setupauthentication.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\adduser.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\adduser.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\adduser.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\adduser.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\edituser.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\edituser.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\findusers.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\findusers.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\manageusers.aspx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\manageusers.aspx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\edituser.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\edituser.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\findusers.aspx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\findusers.aspx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\confirmation.ascx.resx to %WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\confirmation.ascx.resx.[6a99b925].[hopeandhonest@smime.ninja].mkp
from %WINDIR%\microsoft.net\framework\v4.0.30319\_transactionbridgeperfcounters.ini to %WINDIR%\microsoft.net\framework\v4.0.30319\_transactionbridgeperfcounters.ini.[6a99b925].[hopeandhonest@smime.ninja].mkp

Modifies the following files

D:\install.log
C:\far2\addons\colors\default_highlighting\hell.reg
C:\far2\addons\colors\default_highlighting\greenmile.reg
C:\far2\addons\colors\default_highlighting\farcolors242.reg
C:\far2\addons\colors\default_highlighting\dn_like.reg
C:\far2\addons\colors\default_highlighting\descript.ion
C:\far2\addons\colors\default_highlighting\colors_from_sadovoj.reg
C:\far2\addons\colors\default_highlighting\colors_from_gernichenko.reg
C:\far2\addons\colors\default_highlighting\colors_from_admin_essp_ru.reg
C:\far2\addons\colors\default_highlighting\black_from_myodov.reg
C:\far2\addons\colors\default_highlighting\black_from_july.reg
C:\far2\addons\colors\default_highlighting\black_from_fonarev.reg
C:\far2\addons\colors\custom_highlighting\vaxcolors.reg
C:\far2\addons\colors\custom_highlighting\rodion_doroshkevich.reg
C:\far2\addons\colors\custom_highlighting\nc5pal2.reg
C:\far2\addons\colors\custom_highlighting\import_colors.bat
C:\far2\addons\colors\custom_highlighting\hell.reg
C:\far2\addons\colors\custom_highlighting\greenmile.reg
C:\far2\addons\colors\custom_highlighting\farcolors242.reg
C:\far2\addons\colors\custom_highlighting\dn_like.reg
C:\far2\addons\colors\custom_highlighting\descript.ion
C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg
C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg
C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg
C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg
C:\far2\addons\colors\custom_highlighting\black_from_july.reg
C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg
<Drive name for removable media>:\correct.avi
C:\far2\addons\colors\default_highlighting\import_colors.bat
C:\far2\addons\colors\default_highlighting\nc5pal2.reg

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' ' (with hidden window)

Executes the following

'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe'
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' n2696
'<SYSTEM32>\cmd.exe'
'<SYSTEM32>\wbadmin.exe' delete catalog -quiet
'<SYSTEM32>\wbengine.exe'
'<SYSTEM32>\vds.exe'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial