Trojan.Encoder.40829

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BabyLockerKZ' = '"<Full path to file>"'

Creates or modifies the following files

%ProgramFiles%\microsoft office\office14\startup\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\xlstart\how_to_back_files.html

Creates the following files on removable media

<Drive name for removable media>:\how_to_back_files.html
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\alert.htm
<Drive name for removable media>:\advice_process.htm
<Drive name for removable media>:\garden.htm
<Drive name for removable media>:\64bit_notes.htm
<Drive name for removable media>:\ituneshelpunavailable.htm
<Drive name for removable media>:\tree_view.html
<Drive name for removable media>:\systisoft.pem

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Executes the following

'<SYSTEM32>\taskkill.exe' -f -im sqlbrowser.exe
'<SYSTEM32>\net.exe' stop SQLBrowser
'<SYSTEM32>\net.exe' stop SQLAgent$MSFW
'<SYSTEM32>\net.exe' stop SQLAgent$ISARS
'<SYSTEM32>\net.exe' stop MSSQL$MSFW
'<SYSTEM32>\net.exe' stop MSSQL$ISARS
'<SYSTEM32>\net.exe' stop MSSQLServerADHelper100
'<SYSTEM32>\taskkill.exe' -f -impostgres.exe
'<SYSTEM32>\taskkill.exe' -f -im pg_ctl.exe
'<SYSTEM32>\taskkill.exe' -f -im msftesql.exe
'<SYSTEM32>\taskkill.exe' -f -im ReportingServicesService.exe
'<SYSTEM32>\taskkill.exe' -f -im fdhost.exe
'<SYSTEM32>\taskkill.exe' -f -im SQLAGENT.EXE
'<SYSTEM32>\taskkill.exe' -f -im Ssms.exe
'<SYSTEM32>\taskkill.exe' -f -im fdlauncher.exe
'<SYSTEM32>\taskkill.exe' -f -im sqlceip.exe
'<SYSTEM32>\taskkill.exe' -f -im MsDtsSrvr.exe
'<SYSTEM32>\taskkill.exe' -f -im msmdsrv.exe
'<SYSTEM32>\taskkill.exe' -f -im sqlserv.exe
'<SYSTEM32>\taskkill.exe' -f -im sql writer.exe
'<SYSTEM32>\net.exe' stop REportServer$ISARS
'<SYSTEM32>\net.exe' stop SQLWriter

Injects code into

the following system processes:

<SYSTEM32>\wbadmin.exe
<SYSTEM32>\vssadmin.exe

Modifies file system

Creates the following files

D:\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\en-us\css\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\en-us\js\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\images\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\en-us\css\how_to_back_files.html
%ProgramFiles%\windows sidebar\shared gadgets\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\images\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\en-us\js\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\on_desktop\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\en-us\css\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\en-us\js\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\images\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\images\120dpi\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\images\144dpi\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\en-us\js\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\in_sidebar\how_to_back_files.html
%ProgramFiles%\winrar\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\en-us\css\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\en-us\js\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\images\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\en-us\css\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\en-us\js\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\en-us\css\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\en-us\css\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\en-us\js\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\images\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\css\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\images\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\js\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\images\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\en-us\how_to_back_files.html
C:\users\how_to_back_files.html
%ALLUSERSPROFILE%\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\arm\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\devicesync\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\drm\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\drm\server\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\ehome\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\ehome\logs\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\identitycrl\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\media player\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\mf\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\8.0\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\network\connections\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\network\downloader\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\office\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\office\uicaptions\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\network\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\arm\s\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\setup\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\assistance\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\assistance\client\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\dss\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\dss\machinekeys\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\keys\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\rsa\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\device\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\pubba\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\images\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\css\how_to_back_files.html
%ProgramFiles%\microsoft sync framework\v1.0\runtime\how_to_back_files.html
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\how_to_back_files.html
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\how_to_back_files.html
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\1033\how_to_back_files.html
%ProgramFiles%\microsoft synchronization services\how_to_back_files.html
%ProgramFiles%\microsoft synchronization services\ado.net\how_to_back_files.html
%ProgramFiles%\microsoft synchronization services\ado.net\v1.0\how_to_back_files.html
%ProgramFiles%\mozilla firefox\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\chrome\how_to_back_files.html
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\how_to_back_files.html
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\how_to_back_files.html
%ProgramFiles%\mozilla firefox\defaults\how_to_back_files.html
%ProgramFiles%\mozilla firefox\defaults\pref\how_to_back_files.html
%ProgramFiles%\mozilla firefox\distibution\how_to_back_files.html
%ProgramFiles%\mozilla firefox\fonts\how_to_back_files.html
%ProgramFiles%\mozilla firefox\gmp-clearkey\how_to_back_files.html
%ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\how_to_back_files.html
%ProgramFiles%\mozilla firefox\uninstall\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\how_to_back_files.html
%ProgramFiles%\mozilla firefox\browser\how_to_back_files.html
%ProgramFiles%\mozilla firefox\browser\visualelements\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\chrome\icons\how_to_back_files.html
%ProgramFiles%\mozilla firefox\browser\features\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\access\wss\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\queries\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\samples\how_to_back_files.html
%ProgramFiles%\microsoft office\stationery\how_to_back_files.html
%ProgramFiles%\microsoft office\stationery\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\access\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\access\datatype\how_to_back_files.html
%ProgramFiles%\microsoft sync framework\how_to_back_files.html
%ProgramFiles%\microsoft sync framework\v1.0\documentation\how_to_back_files.html
%ProgramFiles%\microsoft sync framework\v1.0\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\onenote\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\onenote\14\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\presentation designs\how_to_back_files.html
%ProgramFiles%\microsoft sql server compact edition\how_to_back_files.html
%ProgramFiles%\microsoft sql server compact edition\v3.5\how_to_back_files.html
%ProgramFiles%\microsoft sql server compact edition\v3.5\desktop\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\access\part\how_to_back_files.html
%ProgramFiles%\microsoft office\templates\1033\fax\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\defaults\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\defaults\pref\how_to_back_files.html
%ProgramFiles%\windows media player\how_to_back_files.html
%ProgramFiles%\windows media player\en-us\how_to_back_files.html
%ProgramFiles%\windows media player\media renderer\how_to_back_files.html
%ProgramFiles%\windows media player\network sharing\how_to_back_files.html
%ProgramFiles%\windows media player\skins\how_to_back_files.html
%ProgramFiles%\windows media player\visualizations\how_to_back_files.html
%ProgramFiles%\windows nt\how_to_back_files.html
%ProgramFiles%\windows journal\templates\how_to_back_files.html
%ProgramFiles%\windows nt\accessories\how_to_back_files.html
%ProgramFiles%\windows mail\en-us\how_to_back_files.html
%ProgramFiles%\windows nt\tabletextservice\how_to_back_files.html
%ProgramFiles%\windows photo viewer\how_to_back_files.html
%ProgramFiles%\windows photo viewer\en-us\how_to_back_files.html
%ProgramFiles%\windows portable devices\how_to_back_files.html
%ProgramFiles%\windows sidebar\how_to_back_files.html
%ProgramFiles%\windows sidebar\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\how_to_back_files.html
%ProgramFiles%\windows nt\accessories\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\how_to_back_files.html
%ProgramFiles%\windows nt\tabletextservice\en-us\how_to_back_files.html
%ProgramFiles%\windows mail\how_to_back_files.html
%ProgramFiles%\windows journal\en-us\how_to_back_files.html
%ProgramFiles%\windows journal\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\features\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\fonts\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\isp\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\uninstall\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\visualelements\how_to_back_files.html
%ProgramFiles%\msbuild\how_to_back_files.html
%ProgramFiles%\msbuild\microsoft\how_to_back_files.html
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\how_to_back_files.html
%ProgramFiles%\mozilla thunderbird\defaults\messenger\how_to_back_files.html
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\how_to_back_files.html
%ProgramFiles%\reference assemblies\how_to_back_files.html
%ProgramFiles%\reference assemblies\microsoft\how_to_back_files.html
%ProgramFiles%\reference assemblies\microsoft\framework\how_to_back_files.html
%ProgramFiles%\reference assemblies\microsoft\framework\v3.0\how_to_back_files.html
%ProgramFiles%\reference assemblies\microsoft\framework\v3.0\redistlist\how_to_back_files.html
%ProgramFiles%\reference assemblies\microsoft\framework\v3.5\how_to_back_files.html
%ProgramFiles%\reference assemblies\microsoft\framework\v3.5\redistlist\how_to_back_files.html
%ProgramFiles%\uninstall information\how_to_back_files.html
%ProgramFiles%\windows defender\how_to_back_files.html
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.5\how_to_back_files.html
%ProgramFiles%\windows defender\en-us\how_to_back_files.html
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\js\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\pubwiz\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\temp\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\vcruntimeadditional_amd64\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\vcruntimeminimum_amd64\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\management\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\how_to_back_files.html
C:\users\public\pictures\sample pictures\how_to_back_files.html
C:\users\public\recorded tv\sample media\how_to_back_files.html
C:\users\public\videos\how_to_back_files.html
C:\users\public\videos\sample videos\how_to_back_files.html
%HOMEPATH%\how_to_back_files.html
%HOMEPATH%\contacts\how_to_back_files.html
%HOMEPATH%\desktop\how_to_back_files.html
%HOMEPATH%\documents\how_to_back_files.html
C:\users\public\pictures\how_to_back_files.html
%HOMEPATH%\downloads\how_to_back_files.html
C:\users\public\recorded tv\how_to_back_files.html
%HOMEPATH%\favorites\links\how_to_back_files.html
%HOMEPATH%\favorites\microsoft websites\how_to_back_files.html
%HOMEPATH%\favorites\msn websites\how_to_back_files.html
%HOMEPATH%\favorites\windows live\how_to_back_files.html
%HOMEPATH%\links\how_to_back_files.html
%HOMEPATH%\music\how_to_back_files.html
%HOMEPATH%\pictures\how_to_back_files.html
%HOMEPATH%\saved games\how_to_back_files.html
%HOMEPATH%\favorites\how_to_back_files.html
C:\users\public\music\sample music\how_to_back_files.html
%HOMEPATH%\favorites\links for united states\how_to_back_files.html
C:\users\public\music\how_to_back_files.html
C:\users\public\libraries\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{fd9b6070-d13e-45dc-819b-41806bf45b6b}\how_to_back_files.html
%ALLUSERSPROFILE%\sun\how_to_back_files.html
%ALLUSERSPROFILE%\sun\java\how_to_back_files.html
%ALLUSERSPROFILE%\sun\java\java update\how_to_back_files.html
C:\users\default\how_to_back_files.html
C:\users\default\desktop\how_to_back_files.html
C:\users\default\documents\how_to_back_files.html
C:\users\default\downloads\how_to_back_files.html
C:\users\default\favorites\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\how_to_back_files.html
C:\users\default\links\how_to_back_files.html
C:\users\default\pictures\how_to_back_files.html
C:\users\default\saved games\how_to_back_files.html
C:\users\default\videos\how_to_back_files.html
C:\users\public\how_to_back_files.html
C:\users\public\desktop\how_to_back_files.html
C:\users\public\documents\how_to_back_files.html
C:\users\public\downloads\how_to_back_files.html
C:\users\public\favorites\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\how_to_back_files.html
C:\users\default\music\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\outbound\how_to_back_files.html
%ALLUSERSPROFILE%\oracle\java\javapath\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\gameexplorer\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\power efficiency diagnostics\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\ringtones\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\sqm\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\sqm\manifest\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\sqm\sessions\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\sqm\upload\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\drm\cache\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\games\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\accessibility\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\config\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\systemindex\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\caches\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\statedata\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\ait\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\temp\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\user account pictures\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\vault\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\inbox\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\queue\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\sentitems\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\wwansvc\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft help\how_to_back_files.html
%ALLUSERSPROFILE%\mozilla\updates\how_to_back_files.html
%ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\how_to_back_files.html
%ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\how_to_back_files.html
%ALLUSERSPROFILE%\oracle\how_to_back_files.html
%ALLUSERSPROFILE%\oracle\java\how_to_back_files.html
%ALLUSERSPROFILE%\oracle\java\installcache_x64\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\wpd\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\support\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\drm\how_to_back_files.html
%ALLUSERSPROFILE%\mozilla\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\activitylog\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\store\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\service\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\templates\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportarchive\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_4017a4527469f9d5b499a101a973ca853f881d9_cab_02612a66\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_4a8ed64bf1962bf234c1a7153259451034e674_cab_0765adcf\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_528c94ccf5464e2e06249b41105333fcda5052_cab_02612a57\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\tablet pc\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\updates\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\localcopy\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\quarantine\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\cachemanager\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\results\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\backup\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\proof\3082\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\proof\1036\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\proof\1033\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\blueprnt\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\boldstri\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\breeze\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\canyon\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\capsules\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\cascade\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\compass\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\concrete\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\blends\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\level\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\axis\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\edge\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\evrgreen\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\expeditn\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\ice\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\indust\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\iris\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\journal\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\layers\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\echo\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\deepblue\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\eclipse\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\smart tag\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\arctic\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\network\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\smart tag\1033\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\smart tag\lists\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\source engine\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\stationery\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\textconv\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\textconv\en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\proof\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\papyrus\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\pixel\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\triedit\en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\vba\vba7\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\vba\vba7\1033\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\vc\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\vgx\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\vsto\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\vsto\10.0\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\vsto\10.0\1033\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\triedit\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\web folders\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\vba\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\web server extensions\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\web server extensions\14\bin\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\web server extensions\14\bin\1033\how_to_back_files.html
%CommonProgramFiles%\services\how_to_back_files.html
%CommonProgramFiles%\speechengines\how_to_back_files.html
%CommonProgramFiles%\speechengines\microsoft\how_to_back_files.html
%CommonProgramFiles%\system\how_to_back_files.html
%CommonProgramFiles%\system\ado\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\web folders\1033\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\translat\fren\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\web server extensions\14\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\translat\frar\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\translat\esen\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\profile\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\radial\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\refined\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\ricepapr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\ripple\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\rmnsque\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\satin\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\sky\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\slate\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\sonora\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\quad\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\spring\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\studio\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\sumipntg\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\water\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\watermar\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\translat\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\translat\arfr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\translat\enes\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\translat\enfr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\strtedge\how_to_back_files.html
%CommonProgramFiles%\system\ado\en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\how_to_back_files.html
%ProgramFiles%\how_to_back_files.html
%CommonProgramFiles%\how_to_back_files.html
%CommonProgramFiles%\designer\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\dw\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\equation\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\equation\1033\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\euro\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\filters\how_to_back_files.html
<Current directory>\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\et-ee\how_to_back_files.html
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\ar-sa\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\bg-bg\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\cs-cz\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\da-dk\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\de-de\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\el-gr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\es-es\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\help\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\grphflt\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\how_to_back_files.html
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\how_to_back_files.html
a:\how_to_back_files.html
C:\kms\how_to_back_files.html
C:\msocache\how_to_back_files.html
C:\msocache\all users\how_to_back_files.html
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fi-fi\how_to_back_files.html
C:\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\how_to_back_files.html
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fr-fr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\sk-sk\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\sv-se\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\th-th\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\tr-tr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\uk-ua\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\zh-cn\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\zh-tw\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\ru-ru\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\msclientdatamgr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\sl-si\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\msinfo\en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\1033\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\cultures\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\msinfo\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\ro-ro\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\pt-pt\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\pt-br\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\he-il\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\hr-hr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\hu-hu\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\it-it\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\ja-jp\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\ko-kr\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\lt-lt\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\lv-lv\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\nb-no\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\nl-nl\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\pl-pl\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\ink\hwrcustomization\how_to_back_files.html
%CommonProgramFiles%\system\en-us\how_to_back_files.html
%CommonProgramFiles%\microsoft shared\themes14\bluecalm\how_to_back_files.html
%CommonProgramFiles%\system\msadc\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\sounds\people\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\sounds\things\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\toolbmps\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\computers\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\sounds\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\certificates\verisign\components\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\sounds\places\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\discussion\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\americana\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\babyblue\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\biscay\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\desert\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightyellow\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\addins\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\bibliography\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\bibliography\sort\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\bibliography\style\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\borders\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\convert\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\convert\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\certificates\verisign\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\accessweb\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\servers\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\document parts\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\forms\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\forms\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\certificates\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\components\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\managedobjects\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\document parts\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\document parts\1033\14\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\en\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\graycheck\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\slate\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\fancy\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\welcome tool\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\toolicons\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\xml files\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\xml files\space templates\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\infopathom\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\infopathom\infopathomv12\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\basic\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\library\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\library\solver\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\media\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\onenote\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\outlookautodiscover\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\pagesize\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\proof\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\infopathomformservicesv12\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\quickstyles\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\library\analysis\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\swirl\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\sts2\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\softblue\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\springgreen\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\sts2\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\americana\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\babyblue\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\oasis\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\biscay\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightyellow\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\desert\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\graycheck\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lime\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\oasis\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\slate\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\softblue\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\springgreen\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\3082\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightorange\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\lime\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\accwiz\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1036\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\pubspapr\how_to_back_files.html
%CommonProgramFiles%\system\msadc\en-us\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\vignette\how_to_back_files.html
%ProgramFiles%\internet explorer\how_to_back_files.html
%ProgramFiles%\internet explorer\en-us\how_to_back_files.html
%ProgramFiles%\internet explorer\signup\how_to_back_files.html
%ProgramFiles%\java\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\bin\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\stacking\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\specialoccasion\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\videowall\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\amd64\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\applet\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\cmm\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\deploy\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\ext\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\fonts\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\images\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\bin\plugin2\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\bin\server\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\sports\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\shatter\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\how_to_back_files.html
%CommonProgramFiles%\system\msmapi\1033\how_to_back_files.html
%CommonProgramFiles%\system\ole db\how_to_back_files.html
%CommonProgramFiles%\system\ole db\en-us\how_to_back_files.html
%ProgramFiles%\dvd maker\how_to_back_files.html
%ProgramFiles%\dvd maker\en-us\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\babyboy\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\babygirl\how_to_back_files.html
%CommonProgramFiles%\system\msmapi\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\flippage\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\huecycle\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\layeredtitles\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\memories\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\oldage\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\performance\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\pets\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\push\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangles\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\resizingpanels\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\full\how_to_back_files.html
%HOMEPATH%\searches\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\jfr\how_to_back_files.html
%ProgramFiles%\microsoft analysis services\as oledb\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\americana\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\babyblue\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\biscay\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightorange\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightyellow\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\desert\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\dataservices\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\lime\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\slate\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\softblue\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\springgreen\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\sts2\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\swirl\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\pubftscm\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\graycheck\how_to_back_files.html
%ProgramFiles%\dvd maker\shared\dvdstyles\travel\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\oasis\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\1033\bibliography\how_to_back_files.html
%ProgramFiles%\microsoft office\office14\how_to_back_files.html
%ProgramFiles%\microsoft office\media\office14\lines\how_to_back_files.html
%ProgramFiles%\microsoft analysis services\as oledb\10\how_to_back_files.html
%ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\how_to_back_files.html
%ProgramFiles%\microsoft analysis services\as oledb\10\resources\how_to_back_files.html
%ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\how_to_back_files.html
%ProgramFiles%\microsoft office\clipart\how_to_back_files.html
%ProgramFiles%\microsoft office\clipart\pub60cor\how_to_back_files.html
%ProgramFiles%\microsoft office\clipart\publisher\how_to_back_files.html
%ProgramFiles%\microsoft analysis services\how_to_back_files.html
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\how_to_back_files.html
%ProgramFiles%\microsoft office\document themes 14\theme colors\how_to_back_files.html
%ProgramFiles%\microsoft office\document themes 14\theme effects\how_to_back_files.html
%ProgramFiles%\microsoft office\document themes 14\theme fonts\how_to_back_files.html
%ProgramFiles%\microsoft office\media\how_to_back_files.html
%ProgramFiles%\microsoft office\media\cagcat10\how_to_back_files.html
%ProgramFiles%\microsoft office\media\cagcat10\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\media\office14\how_to_back_files.html
%ProgramFiles%\microsoft office\media\office14\1033\how_to_back_files.html
%ProgramFiles%\microsoft office\media\office14\autoshap\how_to_back_files.html
%ProgramFiles%\microsoft office\document themes 14\how_to_back_files.html
%ProgramFiles%\microsoft office\media\office14\bullets\how_to_back_files.html
%ProgramFiles%\java\jre1.8.0_45\lib\security\how_to_back_files.html
%HOMEPATH%\videos\how_to_back_files.html

Modifies the following files

<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\archer.avi
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\alert.htm
<Drive name for removable media>:\advice_process.htm
<Drive name for removable media>:\garden.htm
<Drive name for removable media>:\64bit_notes.htm
<Drive name for removable media>:\ituneshelpunavailable.htm

Modifies user data files (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Restarts the analyzed sample

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
'<SYSTEM32>\cmd.exe' /c net stop REportServer$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS
'<SYSTEM32>\net1.exe' stop SQLBrowser
'<SYSTEM32>\cmd.exe' /c net stop SQLBrowser
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser
'<SYSTEM32>\net1.exe' stop SQLAgent$MSFW
'<SYSTEM32>\net1.exe' stop REportServer$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS
'<SYSTEM32>\net1.exe' stop SQLAgent$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS
'<SYSTEM32>\net1.exe' stop MSSQL$MSFW
'<SYSTEM32>\cmd.exe' /c net stop MSSQL$MSFW
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW
'<SYSTEM32>\net1.exe' stop MSSQL$ISARS
'<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c net stop MSSQL$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW
'<SYSTEM32>\cmd.exe' /c net stop SQLAgent$ISARS
'<SYSTEM32>\cmd.exe' /c net stop SQLWriter
'<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTABACKUP -deleteOldest
'<SYSTEM32>\net1.exe' stop SQLWriter
'<SYSTEM32>\bcdedit.exe' /set {default} recoverynabled No
'<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTATEBACKUP
'<SYSTEM32>\wbem\wmic.exe' SHADOWCOPY /nointeractive
'<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet
'<SYSTEM32>\cmd.exe' /c wmic.exe SHADOWCOPY /nointeractive
'<SYSTEM32>\wbadmin.exe' delete backup -keepVersion:0 -quiet
'<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} recoverynabled No
'<SYSTEM32>\cmd.exe' /c wbadmin DELETE SYSTEMSTATEBACKUP
'<SYSTEM32>\cmd.exe' /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
'<SYSTEM32>\cmd.exe' /c wbadmin delete backup -keepVersion:0 -quiet
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLWriter
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
'<SYSTEM32>\cmd.exe' /c net stop SQLAgent$MSFW
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
'<SYSTEM32>\cmd.exe' /c net stop MSSQLServerADHelper100
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
'<SYSTEM32>\net1.exe' stop MSSQLServerADHelper100
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
'<SYSTEM32>\cmd.exe' /c taskkill -f -impostgres.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sqlceip.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im MsDtsSrvr.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im Ssms.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im msmdsrv.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sqlserv.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sql writer.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im fdlauncher.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sqlbrowser.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
'<SYSTEM32>\cmd.exe' /c rem Kill "SQL"
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
'<SYSTEM32>\cmd.exe' /c pause
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im msftesql.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im ReportingServicesService.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im pg_ctl.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im fdhost.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im SQLAGENT.EXE
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLWriter' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe' (with hidden window)

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial