Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.DownLoader10.16780

Added to the Dr.Web virus database: 2013-09-17

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Defender' = '<Full path to virus>'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
  • User Account Control (UAC)
Modifies file system :
Creates the following files:
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c40339fb89b1843376d51559efdc1683_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8a64b277b63f22e470fa2fa4b87d2108_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\6ca9d6d211c22d77c740a11a241597f6_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ad70aeb6155b79f2c5dc31ac9542d695_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\53af4cdc8bcf06ab572f5a4eb2bac428_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\3c5656b41aa54ba8549afa254c9d39e9_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8ed60e677831846e1370f70b4d932b51_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\3393cae9151dc1045ed8651f8cde3efc_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\10dbf740001f93d1afb11085a01e2299_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e592e57df378133cba49c1f3ae67a804_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\411ffbbae2ebbba1d9c0a8bf7acfbbb7_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5c768d034fd432d93ca5bb216a7b8a4b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\709954a7581e8198c951020fb4dc3633_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\108026c61d07310b57b38e447d49ece3_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\f6e197f506ae04db33117440dcb9a6eb_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\fd465eda9780a01b4aee913ef69bb81e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8989e0cc12444dbd800824a045ba5b3c_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\703ac227e2957e35c209006c48bbaa19_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\750895ee885770c4eba87a32fd031a1a_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\fa33ada95c151cbbf4d0cd39f1866eb4_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\71835fef7044ff8914356c49e8452275_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5f9c14ebdb3303f6c4fa52fd20cff71c_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\3fe0655ef1d365bf1896ee154f187951_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\a62a64938e027ee9dc00ff0739db96f9_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\096b507f7fce074bf2ec2baf7de49a47_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\17f244fa8c41f5199692334e12606242_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\578f76215b828299fcb9233faf44eb94_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5f4bb5df051e4386bbba20ab47116337_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e0aa4202c3b44e783e4e2e918632ed60_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\7cb413795da6c04c5c48173270f2c4bf_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\77dff934edf9e4b9c3749925c317be95_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\948b9d2fa219d8e8215ed632fcc102f0_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d1257e9881c28b2fd9469bba7f794971_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\9b4e1f99324bf8693b5d99dbb7e91441_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8531e40c02ae9fdda6ee903e543b0879_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8da01136676bba8ad7abc83ea2e18234_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\666aa488ca5b16aeb2344a5fcdff30ad_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e717eeddff996b1902edf3d65ab3fa0a_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\dd9fcd4e205eabe8c234d75e91277e56_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b6c0fcbf9a13e04a95033306d323179c_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\f5abab101b917fe024eeddbff5d59138_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\7a48a3057c396f3d1b517fcda5474a78_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e979970cfa79fe3859d837b4c213111f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5d627be78fad676ed41d5d18542ad161_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\fd17822f1607506ceca93e43408d7350_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\2f51518ef9893fbcb4a6f69f01cd10a1_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\bcdc9e1077efd98e33abfba3071f79ad_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8f16796fd36a8f43451a6bf4adeb8b7b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\cdfbb9ff90c70b86eb3179978b4f2afe_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\6bcb753d9a084f697372840531dbb5bb_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\da84bdb2a3d163f3ae759d8434068b74_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\635185ec8cedf58c14a58a8649f4c4ad_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\7949d1809eb02e0d743816592822d92b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d9874d45b433a34665ec27f051cadd9f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\890f11463dec3385fc7933adf2da1a23_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ae62b7e5222bde57746b2fe984d91551_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\52ec1bf42b25b372c4f96cfc2a160e20_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d0c14dd816c5afe40ccac4e36a213adc_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\bf35efb3e8aa7044c29f9147edbd7a7c_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\87fecf5367bb010f20605f7c7b4b5ef1_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b6c923a663d5c5bcd14de0537cfa7c64_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\f3881670d42e5a013aa606494035e712_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\23628fc90f0b9520d7aedc92aedfa04f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\640dcca6809c3ec620b2bd2c1bf27b72_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\739bb064023c4e98ba8fe65c37e34623_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\659cd5fe48b4791f6f1e8d59b402516e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\31f1a31e1cb7bd2ea89a705a1a95bf84_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c90b7d4a635ac50c37936be79c4f6542_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b297e1866d66406e0f9fe5ec7dff5585_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\131b35090ed1136aa8f67e8661b8d98a_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\2933d16216d5e0385109d3f50f0bfe80_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\93f906eab92d89f9f2ee9ef48e4232b1_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\454e49039a77adc9057aa574dab23fbb_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5f4df5f1d00a0c93720044eb40d9907b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\acc3c795e4c06a79f2dc0b72fb45a1c9_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\dbf8c1063b1173d1293bde940265803f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\6a4cb522a29ff7200cee92834030a2be_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\60152762c7e0afbace6d4021cdd94d1e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\61ad468e001a4b3ccf17357ff688e74c_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\a43f2e20e88a8edee18702ae98b16020_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\15c29122774faab9c71bc4ecf63ee4d3_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\96a7562bfaaf23dd508f21527cdcb130_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\804c22fc0faf5eff2e84fc14ee7cc208_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b0aa450d2fb09d40a7d7f884aa51d9bf_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\59fc7f75c08cbee391488b1e55524407_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\131b8cc9e8e812b4a3fbb2b2c8c90b7d_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\a8d585df496a8333c7133dc51694f4ad_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b4c47ea32b91adbd3f1e5829aff31484_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\2a310274607a5abfe1cf5753013c9790_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\0da4213423378cfff6ad5811a1c4eeae_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\1eb35364f1fe20ea888ded1b0dd0bf9e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e1904f69a5e0d9eae81cf836565e2c00_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c9eb5e40f02bef9ce4d1be29d8454528_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\34675f105e5d112e8d667422afb79da0_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b8b8b4769a822cde493ab86e74ca545e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\54cb49e65e5c9a155e5c954cfea18165_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e6d1977330dcaa635216cdccbffab2c9_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\480bd4a35a7634b898e691ff419dbaa0_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ca2a1c7a9a7d0767f9b5bbbf621b12c8_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\873c834057aa5635b00e935fb1557e56_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\4d767a1474b37c952f19dc5796d5812a_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e8f96d7f36f532aae61a7553bfff1af1_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\11457d619fbf7e217a0046297cb77ddb_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\feaa42e30bf7d7477e76445417d91172_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e10e88f56b3a0c4f2382ff0db1cb1896_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c98e34dab8d933d8a70031429ed84908_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\0465cc630536cd2fe50ee9a97c3d6051_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\67ac461a40093563bc2c21fea141555e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\bef052062ba977c69286d9505d79f0e2_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\663626ef9032f5dd711a141868618b66_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d7dc05e324153ca221aed8effca165d0_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\66a8a201bde2d6005d2c5e814a6985db_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\87872101e73ea9b9f08f21c3f06f1e64_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\eb012221ab5b696d55cd4530e237bd12_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b38aceebde29264d2eb688833e661906_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b1069244c41c94635998ee18aa9565e5_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\feef61a1ac8da7d62adfccb3c0fc3b39_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\a0875b2bc3b19852342d8311fa388d92_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8c643efc880ed8bac24690d8bfd4cffd_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\a94eecfb5c10ff6e79462fd6374ec509_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\08decf7ff36dc0bfed594a4505033c57_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e750ec1cda4224f014d42ca4af4dcfd9_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d79705c33217b462ebdda611b71cd018_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\f2fff70cbd4ff0fd12f91d7c08410c08_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\85fa47b36e7f9e4bd68a1a6548621ea5_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b44edf7a0e5b8bb73df492d09a0af522_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b39366951a230216994d56dc07461408_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\a9d4309480f2cfc89853bb972f974f8a_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\bb5ac13d5a2e80f40bda926ab9884e87_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d68b4036b084cc686e12b2af52edd204_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\0dcb2f90665e9c8c9a7e07e22bb79dca_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\fa913cb4d90b31429c7809ac6ce7919b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\3127b9a18042e063f0321ff7082365e4_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\bcad0f0904ac33d77c80408f176c930a_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\0139ae57cc319e9d86378f4a0ca61ce3_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\397871bdcc1c946c2ce03fa6e4a5fc0c_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\53aeba66fe64ba9f594c3dafb08857e8_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\730bcf69f637866520bf09d8395d95aa_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\9166af2b002ab951fb9903d4b388bc3f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\f8ed6938e8812a7cdc730ebb262cb377_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\62e10bd774845ec29bc1b84fb803d5c5_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\cae109e00d457d07b40e434343db2891_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\83df6c69f82c0ff3cfcfba7173d4a411_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d5f610dc915339915ad3e10def56a0ae_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\09de0ea1ecb6778ffa757acfdf072ea2_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\38d2243770e3121ab3406ac7f861d528_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\578ddadf45111977f6c3e1d95bdc9cbd_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\665d840cf2e1de2a4226c033c265d988_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\dad110e5-9e6a-4c18-9007-c610a6f64098
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\fd273924e3316a1198249eb091c4d5d3_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\3f72e2e950aa5aa0e7dbbf6789ba2fa3_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\f26987b8d135a35f2e5e7180de202db0_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\772a619e7a5fb66577d7544d7fd9fb1b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\0c70153fa4394c0ac93be63bff462f53_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\77a158790868653a49415bfeb4ca5b2b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\1675dec4958c83382652da10ff557f7b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\36986db316b42c526f96096594fb8c27_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\3092cca6fe5973c49697d73e7bac1874_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\595cf39544915aabc43817c06ffa26f6_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\4babad6c44dce45faf0a279199b3a264_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • C:\Mis Documentos\Documento1.docx
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\84d3c5b3d68ddbf3474649f60d356bc3_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\82a7c85ca6317a52bbd25e0d4d2ce587_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\bc9d5d1b748161fa3199d149e6aaa45a_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e1ce8b2799b8972a10d67ad777e8c09b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\1a5699bb96b52b87fb3016d61e5bc82f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\34a734b2252529a503c10a83f6edcb26_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d3c839d1253aab55d175598f60b44050_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\1e07350668ff0ce9ea3bd4741ead1bc4_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\02723e87639745da3bb0f07d14501cb1_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c83407de5b319c48878745e9623c05f6_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\de4379477fc8e4cb42434e25938eda2f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5d191f11eda51f18feafb7a11bf2b43b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\9a63867b46ff073d665577e0265882da_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\37126484fc8b64574b48ea5f69898d6e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e2cfa70d6292d48fa10f4bce287bbd57_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\209d76a70d2f4995b699bb51bbe96ca0_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e7e4f58159ff2d115235dcbaef7557c6_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ee213c8f758611084c5f1e89d2223e85_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\0590f1ca34be84254012dbe077a9504e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ced6c457d1da7b06caaae66ce6523538_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\36acb43942537f25b1d3a3d0068eac5f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5a01161979438f79d8fa2b995bf16734_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\4bc76e58c9c026770818341b94c46a12_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\3f6241f15205891667436e1eaa12c10f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\92e685be0bd824def2382be27d0ab360_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\9095b2c3207f6629255dded4565c08b8_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\f0f7a644ec3838690c3280d0f5272f54_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e0d7441b321fadf0e4f37ce1f7a0458b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\a0b87ddb3a4316f9b5fa0c554fd15b06_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5eb526ad43444c14a49f9c2dc2bd3cdc_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\592d951f1aaaf0e469aee3bef8f4097f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\2a7e5a96ac454bbefef6ed51b6f7d7c0_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\cc9b11a530c048f5f3caa6b130c8c991_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\502cc3d54d043f351722e4a12d0845f3_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\27f1dfee331eea6e6bb29517ac0ca1c5_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5913389ab0f366e467a4758fd2bfc191_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\6f28a17d2bcd1752d97624e977a2e9b6_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\93c753e4a865ff90d43f47805bd9cebc_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b763a5d17df9e11e80c54c4ed761e1af_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e42f6eaf749ee170c0fe820a852c7f79_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d2bc4b257361c2e8f14c6b8062ffe99f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\133847fa88dd73fdcc796b8a7b903e6b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\0f4df108c30b233ca75321c4efa73a70_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\33ff425da3031c3f8bbb2ad9aa69ed1c_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\066dd6bff74f71919e18889873981074_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\3080a520eec0aad24b0a798a73627270_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\244510cd05a70dd7a8833ff8b27b5d24_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\eb7d3e00c82e7b54424b282e187b572e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b4984b432422084785a4f8a36030f2f8_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\cf79e6cc610f7e2f95bbfeca4f034aa0_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e69f6cc21a139b55041b490c03477ebc_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\f7b2e34c429ae0f616e4e93e61b0bfe1_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\0d1593d6f17c15058c888f4c80225284_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e1e18c51dd618b1e3a19a32576e19793_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d803544d09fd060d4ed87e3971228ddd_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\23f9a52d128437403fed1bc63e1c3156_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\98dd4c051e6c5fbb57f919f67f089252_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\13cbae289e60ce5aac624c8cfe231e7e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8d1218f63a8dbcf9744d6176593d4533_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\63dabbe9360d6ea49c730e8c077df4e6_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\a4aac73b1901a09ca17c75e3e5d46006_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\00b6440c1fe21cdd3dee8653fb1d7dd5_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e5eb7d1371cdfd8e77cbbad9f8ece3b1_23ef5514-3059-436f-a4a7-4cefaab20eb1
Sets the 'hidden' attribute to the following files:
  • <DRIVERS>\etc\hosts
  • <Full path to virus>
Deletes the following files:
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\7949d1809eb02e0d743816592822d92b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\3c5656b41aa54ba8549afa254c9d39e9_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\53af4cdc8bcf06ab572f5a4eb2bac428_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c40339fb89b1843376d51559efdc1683_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ad70aeb6155b79f2c5dc31ac9542d695_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8ed60e677831846e1370f70b4d932b51_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\a62a64938e027ee9dc00ff0739db96f9_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5f4bb5df051e4386bbba20ab47116337_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\578f76215b828299fcb9233faf44eb94_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\17f244fa8c41f5199692334e12606242_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\3fe0655ef1d365bf1896ee154f187951_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5f9c14ebdb3303f6c4fa52fd20cff71c_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\096b507f7fce074bf2ec2baf7de49a47_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8a64b277b63f22e470fa2fa4b87d2108_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\bcdc9e1077efd98e33abfba3071f79ad_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e592e57df378133cba49c1f3ae67a804_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\10dbf740001f93d1afb11085a01e2299_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\2f51518ef9893fbcb4a6f69f01cd10a1_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\cdfbb9ff90c70b86eb3179978b4f2afe_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8f16796fd36a8f43451a6bf4adeb8b7b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\3393cae9151dc1045ed8651f8cde3efc_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\709954a7581e8198c951020fb4dc3633_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5c768d034fd432d93ca5bb216a7b8a4b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\6ca9d6d211c22d77c740a11a241597f6_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ae62b7e5222bde57746b2fe984d91551_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\411ffbbae2ebbba1d9c0a8bf7acfbbb7_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\108026c61d07310b57b38e447d49ece3_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\6bcb753d9a084f697372840531dbb5bb_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\592d951f1aaaf0e469aee3bef8f4097f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5eb526ad43444c14a49f9c2dc2bd3cdc_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\a0b87ddb3a4316f9b5fa0c554fd15b06_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\480bd4a35a7634b898e691ff419dbaa0_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5d191f11eda51f18feafb7a11bf2b43b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\578ddadf45111977f6c3e1d95bdc9cbd_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\2a7e5a96ac454bbefef6ed51b6f7d7c0_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\cc9b11a530c048f5f3caa6b130c8c991_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\3f6241f15205891667436e1eaa12c10f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\4bc76e58c9c026770818341b94c46a12_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\665d840cf2e1de2a4226c033c265d988_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\27f1dfee331eea6e6bb29517ac0ca1c5_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\502cc3d54d043f351722e4a12d0845f3_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ca2a1c7a9a7d0767f9b5bbbf621b12c8_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\703ac227e2957e35c209006c48bbaa19_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\71835fef7044ff8914356c49e8452275_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\fa33ada95c151cbbf4d0cd39f1866eb4_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8989e0cc12444dbd800824a045ba5b3c_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\fd465eda9780a01b4aee913ef69bb81e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\f6e197f506ae04db33117440dcb9a6eb_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\750895ee885770c4eba87a32fd031a1a_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\34675f105e5d112e8d667422afb79da0_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c9eb5e40f02bef9ce4d1be29d8454528_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\54cb49e65e5c9a155e5c954cfea18165_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\da84bdb2a3d163f3ae759d8434068b74_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\52ec1bf42b25b372c4f96cfc2a160e20_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b8b8b4769a822cde493ab86e74ca545e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\890f11463dec3385fc7933adf2da1a23_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\640dcca6809c3ec620b2bd2c1bf27b72_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d7dc05e324153ca221aed8effca165d0_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d0c14dd816c5afe40ccac4e36a213adc_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\f3881670d42e5a013aa606494035e712_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\23628fc90f0b9520d7aedc92aedfa04f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b6c923a663d5c5bcd14de0537cfa7c64_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\4d767a1474b37c952f19dc5796d5812a_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e10e88f56b3a0c4f2382ff0db1cb1896_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\feaa42e30bf7d7477e76445417d91172_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\31f1a31e1cb7bd2ea89a705a1a95bf84_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\873c834057aa5635b00e935fb1557e56_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\11457d619fbf7e217a0046297cb77ddb_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c98e34dab8d933d8a70031429ed84908_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\15c29122774faab9c71bc4ecf63ee4d3_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\93f906eab92d89f9f2ee9ef48e4232b1_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\acc3c795e4c06a79f2dc0b72fb45a1c9_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5f4df5f1d00a0c93720044eb40d9907b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\dbf8c1063b1173d1293bde940265803f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\6a4cb522a29ff7200cee92834030a2be_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\60152762c7e0afbace6d4021cdd94d1e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\454e49039a77adc9057aa574dab23fbb_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\61ad468e001a4b3ccf17357ff688e74c_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\96a7562bfaaf23dd508f21527cdcb130_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\a43f2e20e88a8edee18702ae98b16020_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\804c22fc0faf5eff2e84fc14ee7cc208_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b0aa450d2fb09d40a7d7f884aa51d9bf_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\59fc7f75c08cbee391488b1e55524407_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e8f96d7f36f532aae61a7553bfff1af1_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\a8d585df496a8333c7133dc51694f4ad_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\131b8cc9e8e812b4a3fbb2b2c8c90b7d_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\2a310274607a5abfe1cf5753013c9790_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\0da4213423378cfff6ad5811a1c4eeae_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b4c47ea32b91adbd3f1e5829aff31484_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\1eb35364f1fe20ea888ded1b0dd0bf9e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e1904f69a5e0d9eae81cf836565e2c00_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\fd17822f1607506ceca93e43408d7350_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5d627be78fad676ed41d5d18542ad161_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e979970cfa79fe3859d837b4c213111f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\635185ec8cedf58c14a58a8649f4c4ad_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e6d1977330dcaa635216cdccbffab2c9_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d9874d45b433a34665ec27f051cadd9f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\bef052062ba977c69286d9505d79f0e2_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\2933d16216d5e0385109d3f50f0bfe80_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\131b35090ed1136aa8f67e8661b8d98a_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b297e1866d66406e0f9fe5ec7dff5585_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\659cd5fe48b4791f6f1e8d59b402516e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\739bb064023c4e98ba8fe65c37e34623_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c90b7d4a635ac50c37936be79c4f6542_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\87fecf5367bb010f20605f7c7b4b5ef1_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\663626ef9032f5dd711a141868618b66_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\87872101e73ea9b9f08f21c3f06f1e64_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\66a8a201bde2d6005d2c5e814a6985db_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\bf35efb3e8aa7044c29f9147edbd7a7c_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\67ac461a40093563bc2c21fea141555e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\0465cc630536cd2fe50ee9a97c3d6051_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5a01161979438f79d8fa2b995bf16734_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b4984b432422084785a4f8a36030f2f8_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\eb7d3e00c82e7b54424b282e187b572e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\9a63867b46ff073d665577e0265882da_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\33ff425da3031c3f8bbb2ad9aa69ed1c_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\0f4df108c30b233ca75321c4efa73a70_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\3080a520eec0aad24b0a798a73627270_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\244510cd05a70dd7a8833ff8b27b5d24_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b763a5d17df9e11e80c54c4ed761e1af_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\133847fa88dd73fdcc796b8a7b903e6b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d2bc4b257361c2e8f14c6b8062ffe99f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\93c753e4a865ff90d43f47805bd9cebc_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\6f28a17d2bcd1752d97624e977a2e9b6_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5913389ab0f366e467a4758fd2bfc191_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\066dd6bff74f71919e18889873981074_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d68b4036b084cc686e12b2af52edd204_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\772a619e7a5fb66577d7544d7fd9fb1b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\bb5ac13d5a2e80f40bda926ab9884e87_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\62e10bd774845ec29bc1b84fb803d5c5_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\f8ed6938e8812a7cdc730ebb262cb377_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\9166af2b002ab951fb9903d4b388bc3f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\a9d4309480f2cfc89853bb972f974f8a_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\fa913cb4d90b31429c7809ac6ce7919b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d3c839d1253aab55d175598f60b44050_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\fd273924e3316a1198249eb091c4d5d3_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\0dcb2f90665e9c8c9a7e07e22bb79dca_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\bcad0f0904ac33d77c80408f176c930a_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\3127b9a18042e063f0321ff7082365e4_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\37126484fc8b64574b48ea5f69898d6e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\209d76a70d2f4995b699bb51bbe96ca0_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\1e07350668ff0ce9ea3bd4741ead1bc4_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e2cfa70d6292d48fa10f4bce287bbd57_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d803544d09fd060d4ed87e3971228ddd_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e1e18c51dd618b1e3a19a32576e19793_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e7e4f58159ff2d115235dcbaef7557c6_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ee213c8f758611084c5f1e89d2223e85_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c83407de5b319c48878745e9623c05f6_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\02723e87639745da3bb0f07d14501cb1_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • <DRIVERS>\etc\hosts
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\36acb43942537f25b1d3a3d0068eac5f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ced6c457d1da7b06caaae66ce6523538_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\0590f1ca34be84254012dbe077a9504e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\23f9a52d128437403fed1bc63e1c3156_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\98dd4c051e6c5fbb57f919f67f089252_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\63dabbe9360d6ea49c730e8c077df4e6_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e5eb7d1371cdfd8e77cbbad9f8ece3b1_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e42f6eaf749ee170c0fe820a852c7f79_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8d1218f63a8dbcf9744d6176593d4533_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\13cbae289e60ce5aac624c8cfe231e7e_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\00b6440c1fe21cdd3dee8653fb1d7dd5_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e69f6cc21a139b55041b490c03477ebc_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\cf79e6cc610f7e2f95bbfeca4f034aa0_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\0d1593d6f17c15058c888f4c80225284_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\a4aac73b1901a09ca17c75e3e5d46006_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\de4379477fc8e4cb42434e25938eda2f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\f7b2e34c429ae0f616e4e93e61b0bfe1_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\730bcf69f637866520bf09d8395d95aa_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8531e40c02ae9fdda6ee903e543b0879_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\83df6c69f82c0ff3cfcfba7173d4a411_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\9b4e1f99324bf8693b5d99dbb7e91441_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\7cb413795da6c04c5c48173270f2c4bf_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e0aa4202c3b44e783e4e2e918632ed60_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\948b9d2fa219d8e8215ed632fcc102f0_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d1257e9881c28b2fd9469bba7f794971_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\bc9d5d1b748161fa3199d149e6aaa45a_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d5f610dc915339915ad3e10def56a0ae_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\34a734b2252529a503c10a83f6edcb26_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\38d2243770e3121ab3406ac7f861d528_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\82a7c85ca6317a52bbd25e0d4d2ce587_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\84d3c5b3d68ddbf3474649f60d356bc3_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\77dff934edf9e4b9c3749925c317be95_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\f0f7a644ec3838690c3280d0f5272f54_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\9095b2c3207f6629255dded4565c08b8_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e717eeddff996b1902edf3d65ab3fa0a_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\92e685be0bd824def2382be27d0ab360_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\09de0ea1ecb6778ffa757acfdf072ea2_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e0d7441b321fadf0e4f37ce1f7a0458b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\666aa488ca5b16aeb2344a5fcdff30ad_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\cae109e00d457d07b40e434343db2891_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\f5abab101b917fe024eeddbff5d59138_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b6c0fcbf9a13e04a95033306d323179c_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8da01136676bba8ad7abc83ea2e18234_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\dd9fcd4e205eabe8c234d75e91277e56_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\7a48a3057c396f3d1b517fcda5474a78_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\1a5699bb96b52b87fb3016d61e5bc82f_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b38aceebde29264d2eb688833e661906_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\eb012221ab5b696d55cd4530e237bd12_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\feef61a1ac8da7d62adfccb3c0fc3b39_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b44edf7a0e5b8bb73df492d09a0af522_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\85fa47b36e7f9e4bd68a1a6548621ea5_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b1069244c41c94635998ee18aa9565e5_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\a94eecfb5c10ff6e79462fd6374ec509_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\53aeba66fe64ba9f594c3dafb08857e8_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\397871bdcc1c946c2ce03fa6e4a5fc0c_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\0139ae57cc319e9d86378f4a0ca61ce3_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8c643efc880ed8bac24690d8bfd4cffd_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\f26987b8d135a35f2e5e7180de202db0_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\a0875b2bc3b19852342d8311fa388d92_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\b39366951a230216994d56dc07461408_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\0c70153fa4394c0ac93be63bff462f53_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\36986db316b42c526f96096594fb8c27_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\4babad6c44dce45faf0a279199b3a264_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e1ce8b2799b8972a10d67ad777e8c09b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\1675dec4958c83382652da10ff557f7b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\77a158790868653a49415bfeb4ca5b2b_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\595cf39544915aabc43817c06ffa26f6_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\08decf7ff36dc0bfed594a4505033c57_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\f2fff70cbd4ff0fd12f91d7c08410c08_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\3f72e2e950aa5aa0e7dbbf6789ba2fa3_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\3092cca6fe5973c49697d73e7bac1874_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d79705c33217b462ebdda611b71cd018_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e750ec1cda4224f014d42ca4af4dcfd9_23ef5514-3059-436f-a4a7-4cefaab20eb1
Substitutes the HOSTS file.
Network activity:
Connects to:
  • 'bs###oframap.ru':80
  • 'wp#d':80
TCP:
HTTP GET requests:
  • bs###oframap.ru/image/petli/robots.txt
  • wp#d/wpad.dat
UDP:
  • DNS ASK bs###oframap.ru
  • DNS ASK wp#d

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android