Trojan.Encoder.40826

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BabyLockerKZ' = '"<Full path to file>"'

Creates or modifies the following files

%ProgramFiles%\microsoft office\office14\startup\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\xlstart\how_to_back_files.html

Creates the following files on removable media

<Drive name for removable media>:\how_to_back_files.html
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\contoso.cer

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Executes the following

'<SYSTEM32>\taskkill.exe' -f -im sqlbrowser.exe
'<SYSTEM32>\net.exe' stop SQLBrowser
'<SYSTEM32>\net.exe' stop SQLAgent$MSFW
'<SYSTEM32>\net.exe' stop SQLAgent$ISARS
'<SYSTEM32>\net.exe' stop MSSQL$MSFW
'<SYSTEM32>\net.exe' stop MSSQL$ISARS
'<SYSTEM32>\net.exe' stop MSSQLServerADHelper100
'<SYSTEM32>\taskkill.exe' -f -impostgres.exe
'<SYSTEM32>\taskkill.exe' -f -im pg_ctl.exe
'<SYSTEM32>\taskkill.exe' -f -im msftesql.exe
'<SYSTEM32>\taskkill.exe' -f -im ReportingServicesService.exe
'<SYSTEM32>\taskkill.exe' -f -im fdhost.exe
'<SYSTEM32>\taskkill.exe' -f -im SQLAGENT.EXE
'<SYSTEM32>\taskkill.exe' -f -im Ssms.exe
'<SYSTEM32>\taskkill.exe' -f -im fdlauncher.exe
'<SYSTEM32>\taskkill.exe' -f -im sqlceip.exe
'<SYSTEM32>\taskkill.exe' -f -im MsDtsSrvr.exe
'<SYSTEM32>\taskkill.exe' -f -im msmdsrv.exe
'<SYSTEM32>\taskkill.exe' -f -im sqlserv.exe
'<SYSTEM32>\taskkill.exe' -f -im sql writer.exe
'<SYSTEM32>\net.exe' stop REportServer$ISARS
'<SYSTEM32>\net.exe' stop SQLWriter

Injects code into

the following system processes:

<SYSTEM32>\wbadmin.exe
<SYSTEM32>\vssadmin.exe

Modifies file system

Creates the following files

a:\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\welcome tool\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\toolicons\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\xml files\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\xml files\space templates\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\infopathom\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\infopathom\infopathomv12\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\softblue\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\library\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\library\analysis\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\library\solver\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\media\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\onenote\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\outlookautodiscover\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\fancy\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\basic\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\swirl\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\sts2\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\springgreen\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\infopathomformservicesv12\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\slate\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\oasis\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lime\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\graycheck\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\desert\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightyellow\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightorange\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\pagesize\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\how_to_back_files.html
%ProgramFiles%\microsoft synchronization services\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\proof\1036\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\presentation designs\how_to_back_files.html
%ProgramFiles%\microsoft sql server compact edition\how_to_back_files.html
%ProgramFiles%\microsoft sql server compact edition\v3.5\how_to_back_files.html
%ProgramFiles%\microsoft sql server compact edition\v3.5\desktop\how_to_back_files.html
%ProgramFiles%\microsoft sync framework\how_to_back_files.html
%ProgramFiles%\microsoft sync framework\v1.0\documentation\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\proof\how_to_back_files.html
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\how_to_back_files.html
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\how_to_back_files.html
%ProgramFiles%\microsoft sync framework\v1.0\runtime\how_to_back_files.html
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\how_to_back_files.html
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\how_to_back_files.html
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\onenote\14\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\onenote\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\fax\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\access\wss\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\access\part\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\access\datatype\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\access\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\biscay\how_to_back_files.html
%ProgramFiles%\microsoft office\stationery\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\stationery\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\samples\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\queries\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\pubwiz\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\pubba\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\proof\3082\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\proof\1033\how_to_back_files.html
%ProgramFiles%\microsoft sync framework\v1.0\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\babyblue\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\lime\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\convert\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\convert\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\document parts\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\document parts\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\document parts\1033\14\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\en\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\forms\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\quickstyles\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\certificates\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\components\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\managedobjects\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\servers\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\borders\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\bibliography\style\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\bibliography\sort\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\bibliography\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\addins\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\accwiz\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\accessweb\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\3082\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1036\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\forms\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\pubspapr\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\pubftscm\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\swirl\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\sts2\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\springgreen\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\softblue\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\certificates\verisign\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\computers\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\sounds\people\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\babyblue\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\biscay\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightyellow\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\desert\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\graycheck\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\oasis\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\certificates\verisign\components\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\slate\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\softblue\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\springgreen\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\sts2\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\americana\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\discussion\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\americana\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\toolbmps\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\sounds\things\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\sounds\places\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\sounds\how_to_back_files.html
%ProgramFiles%\microsoft synchronization services\ado.net\how_to_back_files.html
%ProgramFiles%\microsoft synchronization services\ado.net\v1.0\how_to_back_files.html
%ProgramFiles%\mozilla firefox\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\images\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\en-us\css\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\en-us\js\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\images\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\images\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\en-us\css\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\en-us\js\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\in_sidebar\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\on_desktop\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\en-us\js\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\en-us\css\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\js\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\images\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\css\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\en-us\js\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\images\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\en-us\js\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\en-us\css\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\en-us\css\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\en-us\css\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\images\144dpi\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\enu\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\locale\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\locale\en_us\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\pmp\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\mpp\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\browser\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\how_to_back_files.html
%ProgramFiles%\windows sidebar\shared gadgets\how_to_back_files.html
%ProgramFiles%\winrar\how_to_back_files.html
%ProgramFiles(x86)%\how_to_back_files.html
%ProgramFiles(x86)%\adobe\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\en-us\js\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\images\120dpi\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\images\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\locales\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\air\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\esl\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\images\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\en-us\js\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\defaults\pref\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\features\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\fonts\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\isp\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\uninstall\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\visualelements\how_to_back_files.html
%ProgramFiles%\msbuild\microsoft\how_to_back_files.html
%ProgramFiles%\reference assemblies\microsoft\framework\v3.5\how_to_back_files.html
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\how_to_back_files.html
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\how_to_back_files.html
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.5\how_to_back_files.html
%ProgramFiles%\reference assemblies\how_to_back_files.html
%ProgramFiles%\reference assemblies\microsoft\how_to_back_files.html
%ProgramFiles%\reference assemblies\microsoft\framework\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\defaults\messenger\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\defaults\how_to_back_files.html
%ProgramFiles%\mozilla firefox\browser\how_to_back_files.html
%ProgramFiles%\mozilla firefox\gmp-clearkey\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\chrome\icons\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\chrome\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\how_to_back_files.html
%ProgramFiles%\mozilla firefox\uninstall\how_to_back_files.html
%ProgramFiles%\msbuild\how_to_back_files.html
%ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\how_to_back_files.html
%ProgramFiles%\reference assemblies\microsoft\framework\v3.0\redistlist\how_to_back_files.html
%ProgramFiles%\mozilla firefox\distibution\how_to_back_files.html
%ProgramFiles%\mozilla firefox\defaults\pref\how_to_back_files.html
%ProgramFiles%\mozilla firefox\defaults\how_to_back_files.html
%ProgramFiles%\mozilla firefox\browser\visualelements\how_to_back_files.html
%ProgramFiles%\mozilla firefox\browser\features\how_to_back_files.html
%ProgramFiles%\mozilla firefox\fonts\how_to_back_files.html
%ProgramFiles%\reference assemblies\microsoft\framework\v3.0\how_to_back_files.html
%ProgramFiles%\reference assemblies\microsoft\framework\v3.5\redistlist\how_to_back_files.html
%ProgramFiles%\windows photo viewer\how_to_back_files.html
%ProgramFiles%\windows portable devices\how_to_back_files.html
%ProgramFiles%\windows sidebar\how_to_back_files.html
%ProgramFiles%\windows sidebar\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\how_to_back_files.html
%ProgramFiles%\windows nt\tabletextservice\en-us\how_to_back_files.html
%ProgramFiles%\uninstall information\how_to_back_files.html
%ProgramFiles%\windows photo viewer\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\images\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\en-us\css\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\css\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\js\how_to_back_files.html
%ProgramFiles%\windows media player\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\slate\how_to_back_files.html
%ProgramFiles%\windows nt\accessories\how_to_back_files.html
%ProgramFiles%\windows nt\how_to_back_files.html
%ProgramFiles%\windows media player\visualizations\how_to_back_files.html
%ProgramFiles%\windows media player\skins\how_to_back_files.html
%ProgramFiles%\windows media player\network sharing\how_to_back_files.html
%ProgramFiles%\windows media player\media renderer\how_to_back_files.html
%ProgramFiles%\windows media player\en-us\how_to_back_files.html
%ProgramFiles%\windows nt\tabletextservice\how_to_back_files.html
%ProgramFiles%\windows mail\en-us\how_to_back_files.html
%ProgramFiles%\windows mail\how_to_back_files.html
%ProgramFiles%\windows journal\templates\how_to_back_files.html
%ProgramFiles%\windows journal\en-us\how_to_back_files.html
%ProgramFiles%\windows journal\how_to_back_files.html
%ProgramFiles%\windows defender\en-us\how_to_back_files.html
%ProgramFiles%\windows defender\how_to_back_files.html
%ProgramFiles%\windows nt\accessories\en-us\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\oasis\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\tr-tr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\cultures\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\1033\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\msinfo\en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\msinfo\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\msclientdatamgr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\zh-tw\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\zh-cn\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\uk-ua\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\th-th\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\sv-se\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\sl-si\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\sk-sk\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\ru-ru\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\ro-ro\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\stationery\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\indust\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\boldstri\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\breeze\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\canyon\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\capsules\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\cascade\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\compass\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\deepblue\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\echo\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\eclipse\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\edge\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\evrgreen\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\expeditn\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\ice\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\blueprnt\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\bluecalm\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\blends\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\axis\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\arctic\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\textconv\en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\textconv\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\pt-pt\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\source engine\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\smart tag\lists\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\smart tag\1033\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\smart tag\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\proof\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\concrete\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\pt-br\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\hu-hu\how_to_back_files.html
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\how_to_back_files.html
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\how_to_back_files.html
%CommonProgramFiles%\how_to_back_files.html
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\how_to_back_files.html
%CommonProgramFiles%\designer\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\dw\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\equation\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\equation\1033\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\euro\how_to_back_files.html
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\how_to_back_files.html
%ProgramFiles%\how_to_back_files.html
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\how_to_back_files.html
C:\msocache\how_to_back_files.html
D:\how_to_back_files.html
C:\kms\how_to_back_files.html
C:\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\filters\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\es-es\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\nl-nl\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\he-il\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\hr-hr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\hwrcustomization\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\grphflt\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\it-it\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\ja-jp\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\ko-kr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\lt-lt\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\lv-lv\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\nb-no\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fr-fr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fi-fi\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\et-ee\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\pl-pl\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\el-gr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\de-de\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\da-dk\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\cs-cz\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\bg-bg\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\ar-sa\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\help\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\iris\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\journal\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\layers\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\deploy\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\bin\plugin2\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\bin\server\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\amd64\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\applet\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\cmm\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\ext\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\travel\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\fonts\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\images\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\jfr\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\management\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\security\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\bin\how_to_back_files.html
%ProgramFiles%\internet explorer\signup\how_to_back_files.html
%ProgramFiles%\internet explorer\en-us\how_to_back_files.html
%ProgramFiles%\internet explorer\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\vignette\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\videowall\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\stacking\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\pets\how_to_back_files.html
%ProgramFiles%\microsoft analysis services\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\specialoccasion\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\shatter\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\resizingpanels\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangles\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\push\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\sports\how_to_back_files.html
%ProgramFiles%\java\how_to_back_files.html
%ProgramFiles%\microsoft analysis services\as oledb\how_to_back_files.html
%ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\media\office14\bullets\how_to_back_files.html
%ProgramFiles%\microsoft office\media\office14\lines\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\bibliography\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\dataservices\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\how_to_back_files.html
%ProgramFiles%\microsoft office\media\office14\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\americana\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\babyblue\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\biscay\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightorange\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightyellow\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\desert\how_to_back_files.html
%ProgramFiles%\microsoft office\media\office14\autoshap\how_to_back_files.html
%ProgramFiles%\microsoft office\media\office14\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\graycheck\how_to_back_files.html
%ProgramFiles%\microsoft office\how_to_back_files.html
%ProgramFiles%\microsoft office\clipart\how_to_back_files.html
%ProgramFiles%\microsoft office\clipart\pub60cor\how_to_back_files.html
%ProgramFiles%\microsoft office\clipart\publisher\how_to_back_files.html
%ProgramFiles%\microsoft analysis services\as oledb\10\how_to_back_files.html
%ProgramFiles%\microsoft analysis services\as oledb\10\resources\how_to_back_files.html
%ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\how_to_back_files.html
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\how_to_back_files.html
%ProgramFiles%\microsoft office\document themes 14\theme fonts\how_to_back_files.html
%ProgramFiles%\microsoft office\media\how_to_back_files.html
%ProgramFiles%\microsoft office\media\cagcat10\how_to_back_files.html
%ProgramFiles%\microsoft office\media\cagcat10\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\document themes 14\how_to_back_files.html
%ProgramFiles%\microsoft office\document themes 14\theme colors\how_to_back_files.html
%ProgramFiles%\microsoft office\document themes 14\theme effects\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\performance\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\oldage\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\memories\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\strtedge\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\studio\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\sumipntg\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\water\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\watermar\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\translat\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\translat\enes\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\vba\vba7\1033\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\translat\enfr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\translat\esen\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\translat\frar\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\translat\fren\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\triedit\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\triedit\en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\spring\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\sonora\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\level\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\refined\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\slate\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\sky\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\satin\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\rmnsque\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\ripple\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\translat\arfr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\ricepapr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\vba\vba7\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\quad\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\profile\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\pixel\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\papyrus\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\network\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\radial\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\vba\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\vc\how_to_back_files.html
%CommonProgramFiles%\system\msmapi\how_to_back_files.html
%CommonProgramFiles%\system\ole db\how_to_back_files.html
%CommonProgramFiles%\system\ole db\en-us\how_to_back_files.html
%ProgramFiles%\dvd maker\how_to_back_files.html
%ProgramFiles%\dvd maker\en-us\how_to_back_files.html
%CommonProgramFiles%\system\msadc\en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\vgx\how_to_back_files.html
%CommonProgramFiles%\system\msmapi\1033\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\flippage\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\full\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\huecycle\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\layeredtitles\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\babyboy\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\babygirl\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\web server extensions\14\bin\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\lime\how_to_back_files.html
%CommonProgramFiles%\system\ado\en-us\how_to_back_files.html
%CommonProgramFiles%\system\ado\how_to_back_files.html
%CommonProgramFiles%\system\how_to_back_files.html
%CommonProgramFiles%\speechengines\microsoft\how_to_back_files.html
%CommonProgramFiles%\speechengines\how_to_back_files.html
%CommonProgramFiles%\services\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\web server extensions\14\bin\1033\how_to_back_files.html
%CommonProgramFiles%\system\msadc\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\web server extensions\14\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\web server extensions\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\web folders\1033\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\web folders\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\vsto\10.0\1033\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\vsto\10.0\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\vsto\how_to_back_files.html
%CommonProgramFiles%\system\en-us\how_to_back_files.html
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\prc\how_to_back_files.html

Modifies the following files

C:\kms\kms_vl_all_aio.cmd
C:\kms\kms_vl_all_aio_debug.log
<Drive name for removable media>:\archer.avi
<Drive name for removable media>:\delete.avi
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Restarts the analyzed sample

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
'<SYSTEM32>\cmd.exe' /c net stop REportServer$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS
'<SYSTEM32>\net1.exe' stop SQLBrowser
'<SYSTEM32>\cmd.exe' /c net stop SQLBrowser
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser
'<SYSTEM32>\net1.exe' stop SQLAgent$MSFW
'<SYSTEM32>\net1.exe' stop REportServer$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS
'<SYSTEM32>\net1.exe' stop SQLAgent$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS
'<SYSTEM32>\net1.exe' stop MSSQL$MSFW
'<SYSTEM32>\cmd.exe' /c net stop MSSQL$MSFW
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW
'<SYSTEM32>\net1.exe' stop MSSQL$ISARS
'<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTABACKUP -deleteOldest
'<SYSTEM32>\cmd.exe' /c net stop MSSQL$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW
'<SYSTEM32>\cmd.exe' /c net stop SQLAgent$ISARS
'<SYSTEM32>\cmd.exe' /c net stop SQLWriter
'<SYSTEM32>\wbem\wmic.exe' SHADOWCOPY /nointeractive
'<SYSTEM32>\net1.exe' stop SQLWriter
'<SYSTEM32>\bcdedit.exe' /set {default} recoverynabled No
'<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\wbadmin.exe' delete backup -keepVersion:0 -quiet
'<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTATEBACKUP
'<SYSTEM32>\cmd.exe' /c wbadmin delete backup -keepVersion:0 -quiet
'<SYSTEM32>\cmd.exe' /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
'<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet
'<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} recoverynabled No
'<SYSTEM32>\cmd.exe' /c wmic.exe SHADOWCOPY /nointeractive
'<SYSTEM32>\cmd.exe' /c wbadmin DELETE SYSTEMSTATEBACKUP
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLWriter
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
'<SYSTEM32>\cmd.exe' /c net stop SQLAgent$MSFW
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
'<SYSTEM32>\cmd.exe' /c net stop MSSQLServerADHelper100
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
'<SYSTEM32>\net1.exe' stop MSSQLServerADHelper100
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
'<SYSTEM32>\cmd.exe' /c taskkill -f -impostgres.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sqlceip.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im MsDtsSrvr.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im Ssms.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im msmdsrv.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sqlserv.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sql writer.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im fdlauncher.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sqlbrowser.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
'<SYSTEM32>\cmd.exe' /c rem Kill "SQL"
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
'<SYSTEM32>\cmd.exe' /c pause
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im msftesql.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im ReportingServicesService.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im pg_ctl.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im fdhost.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im SQLAGENT.EXE
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLWriter' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe' (with hidden window)

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial