Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'F967204E7FFAA35C' = '%APPDATA%\Roaming\svcvtb.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'F967204E7FFAA35C' = '%APPDATA%\Roaming\svcvtb.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\Roaming\svcvtb.exe'
Executes the following:
- '<SYSTEM32>\svchost.exe' -k swprv
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\vssadmin.exe' delete shadows /all /Quiet
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
the following user processes:
- ecmd.exe
Modifies file system :
Creates the following files:
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Roaming\Media Center Programs\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Roaming\Media Center Programs\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\help_restore_files_yddrf.txt
- C:\Users\Default\Saved Games\help_restore_files_yddrf.html
- C:\Users\Default\Saved Games\help_restore_files_yddrf.txt
- C:\Users\Default\help_restore_files_yddrf.html
- C:\Users\Default\help_restore_files_yddrf.txt
- C:\Users\Default\Favorites\help_restore_files_yddrf.html
- C:\Users\Default\Favorites\help_restore_files_yddrf.txt
- C:\Users\Default\Links\help_restore_files_yddrf.html
- C:\Users\Default\Links\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Microsoft\CryptnetUrlCache\Content\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Microsoft\CryptnetUrlCache\Content\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Microsoft\CryptnetUrlCache\MetaData\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Microsoft\CryptnetUrlCache\MetaData\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\EmieSiteList\help_restore_files_yddrf.html
- <LS_APPDATA>Low\EmieSiteList\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\EmieUserList\help_restore_files_yddrf.html
- <LS_APPDATA>Low\EmieUserList\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\help_restore_files_yddrf.html
- C:\Users\Default\AppData\help_restore_files_yddrf.txt
- C:\Users\Default\Music\help_restore_files_yddrf.html
- C:\Users\Default\Music\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Roaming\Microsoft\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Roaming\Microsoft\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Roaming\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Roaming\help_restore_files_yddrf.txt
- C:\Users\Default\Documents\help_restore_files_yddrf.html
- C:\Users\Default\Documents\help_restore_files_yddrf.txt
- C:\Users\Default\Downloads\help_restore_files_yddrf.html
- C:\Users\Default\Downloads\help_restore_files_yddrf.txt
- C:\Users\Default\Pictures\help_restore_files_yddrf.html
- C:\Users\Default\Pictures\help_restore_files_yddrf.txt
- C:\Users\Default\Videos\help_restore_files_yddrf.html
- C:\Users\Default\Videos\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Local\Temp\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows NT\MSFax\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows NT\MSScan\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\SentItems\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\WwanSvc\help_restore_files_yddrf.html
- C:\ProgramData\Oracle\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows NT\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows NT\MSScan\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\WwanSvc\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows NT\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows Defender\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows Defender\Support\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows Defender\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows Defender\Support\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows NT\MSFax\Queue\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\Inbox\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows NT\MSFax\SentItems\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\Queue\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows NT\MSFax\Inbox\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Local\Microsoft\Windows\History\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Local\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Local\Microsoft\Windows\History\help_restore_files_yddrf.html
- C:\ProgramData\Sun\help_restore_files_yddrf.txt
- C:\ProgramData\Sun\Java\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Local\help_restore_files_yddrf.txt
- C:\ProgramData\Sun\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Local\Microsoft\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Local\Microsoft\Windows\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Local\Temp\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Local\Microsoft\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\help_restore_files_yddrf.html
- C:\Users\Default\AppData\Local\Microsoft\Windows\help_restore_files_yddrf.txt
- C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\help_restore_files_yddrf.html
- C:\ProgramData\Package Cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\help_restore_files_yddrf.txt
- C:\ProgramData\Package Cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\help_restore_files_yddrf.html
- C:\ProgramData\Package Cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\help_restore_files_yddrf.txt
- C:\ProgramData\Package Cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\help_restore_files_yddrf.html
- C:\ProgramData\Package Cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\help_restore_files_yddrf.txt
- C:\ProgramData\Oracle\help_restore_files_yddrf.html
- C:\ProgramData\Package Cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\help_restore_files_yddrf.txt
- C:\ProgramData\Package Cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\help_restore_files_yddrf.html
- C:\ProgramData\Sun\Java\Java Update\help_restore_files_yddrf.txt
- C:\ProgramData\Package Cache\help_restore_files_yddrf.html
- C:\ProgramData\Sun\Java\help_restore_files_yddrf.txt
- C:\ProgramData\Sun\Java\Java Update\help_restore_files_yddrf.html
- C:\ProgramData\Package Cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\help_restore_files_yddrf.txt
- C:\ProgramData\Package Cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\help_restore_files_yddrf.html
- C:\ProgramData\Package Cache\help_restore_files_yddrf.txt
- C:\ProgramData\Package Cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\help_restore_files_yddrf.html
- %APPDATA%\Roaming\Microsoft\Windows\Recent\help_restore_files_yddrf.txt
- %APPDATA%\Roaming\Microsoft\Windows\Printer Shortcuts\help_restore_files_yddrf.html
- %HOMEPATH%\Saved Games\help_restore_files_yddrf.txt
- %APPDATA%\Roaming\Microsoft\Windows\Recent\help_restore_files_yddrf.html
- %APPDATA%\Roaming\Microsoft\Windows\Network Shortcuts\help_restore_files_yddrf.txt
- <LS_APPDATA>\help_restore_files_yddrf.html
- %APPDATA%\Roaming\Microsoft\Windows\Printer Shortcuts\help_restore_files_yddrf.txt
- %APPDATA%\Roaming\Microsoft\Windows\Network Shortcuts\help_restore_files_yddrf.html
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\help_restore_files_yddrf.txt
- %APPDATA%\Roaming\Microsoft\Windows\SendTo\help_restore_files_yddrf.html
- %APPDATA%\Roaming\Microsoft\Windows\Templates\help_restore_files_yddrf.txt
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\help_restore_files_yddrf.html
- %HOMEPATH%\Searches\help_restore_files_yddrf.txt
- %HOMEPATH%\Saved Games\help_restore_files_yddrf.html
- %APPDATA%\Roaming\Microsoft\Windows\SendTo\help_restore_files_yddrf.txt
- %HOMEPATH%\Searches\help_restore_files_yddrf.html
- %HOMEPATH%\Favorites\Microsoft Websites\help_restore_files_yddrf.txt
- %HOMEPATH%\Favorites\Links\help_restore_files_yddrf.html
- %HOMEPATH%\Favorites\MSN Websites\help_restore_files_yddrf.txt
- %HOMEPATH%\Favorites\Microsoft Websites\help_restore_files_yddrf.html
- %HOMEPATH%\Downloads\help_restore_files_yddrf.txt
- %HOMEPATH%\Documents\help_restore_files_yddrf.html
- %HOMEPATH%\Favorites\Links\help_restore_files_yddrf.txt
- %HOMEPATH%\Downloads\help_restore_files_yddrf.html
- %HOMEPATH%\Links\help_restore_files_yddrf.txt
- %HOMEPATH%\Favorites\help_restore_files_yddrf.html
- <LS_APPDATA>\help_restore_files_yddrf.txt
- %HOMEPATH%\Links\help_restore_files_yddrf.html
- %HOMEPATH%\Favorites\Windows Live\help_restore_files_yddrf.txt
- %HOMEPATH%\Favorites\MSN Websites\help_restore_files_yddrf.html
- %HOMEPATH%\Favorites\help_restore_files_yddrf.txt
- %HOMEPATH%\Favorites\Windows Live\help_restore_files_yddrf.html
- C:\Users\Public\Recorded TV\help_restore_files_yddrf.txt
- C:\Users\Public\Recorded TV\Sample Media\help_restore_files_yddrf.html
- C:\Users\Public\Videos\Sample Videos\help_restore_files_yddrf.txt
- C:\Users\Public\Recorded TV\help_restore_files_yddrf.html
- C:\Users\Public\Pictures\Sample Pictures\help_restore_files_yddrf.txt
- C:\Users\Public\Music\Sample Music\help_restore_files_yddrf.html
- C:\Users\Public\Recorded TV\Sample Media\help_restore_files_yddrf.txt
- C:\Users\Public\Pictures\Sample Pictures\help_restore_files_yddrf.html
- \Device\HarddiskVolume3\$RECYCLE.BIN\help_restore_files_yddrf.txt
- \Device\HarddiskVolume3\$RECYCLE.BIN\S-1-5-21-2832440558-3064306045-1455513625-1000\help_restore_files_yddrf.html
- \Device\HarddiskVolume3\books\SpeakOut.pdf
- \Device\HarddiskVolume3\$RECYCLE.BIN\help_restore_files_yddrf.html
- C:\Users\Public\help_restore_files_yddrf.txt
- C:\Users\Public\Videos\Sample Videos\help_restore_files_yddrf.html
- \Device\HarddiskVolume3\$RECYCLE.BIN\S-1-5-21-2832440558-3064306045-1455513625-1000\help_restore_files_yddrf.txt
- C:\Users\Public\help_restore_files_yddrf.html
- C:\Users\Public\Music\help_restore_files_yddrf.txt
- %HOMEPATH%\help_restore_files_yddrf.html
- C:\Users\Public\Pictures\help_restore_files_yddrf.txt
- C:\Users\Public\Music\help_restore_files_yddrf.html
- %HOMEPATH%\voip\help_restore_files_yddrf.txt
- %APPDATA%\Roaming\Microsoft\Windows\Templates\help_restore_files_yddrf.html
- %HOMEPATH%\help_restore_files_yddrf.txt
- %HOMEPATH%\voip\help_restore_files_yddrf.html
- C:\Users\Public\Libraries\help_restore_files_yddrf.txt
- C:\Users\Public\Downloads\help_restore_files_yddrf.html
- C:\Users\Public\Music\Sample Music\help_restore_files_yddrf.txt
- C:\Users\Public\Libraries\help_restore_files_yddrf.html
- C:\Users\Public\Videos\help_restore_files_yddrf.txt
- C:\Users\Public\Pictures\help_restore_files_yddrf.html
- C:\Users\Public\Downloads\help_restore_files_yddrf.txt
- C:\Users\Public\Videos\help_restore_files_yddrf.html
- %HOMEPATH%\Documents\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\Services\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Microsoft\Internet Explorer\Services\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Microsoft\Internet Explorer\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\W6LZ144V\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\W6LZ144V\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Microsoft\Windows\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Microsoft\Windows\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Microsoft\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Microsoft\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Microsoft\Windows\AppCache\BDOU7LW5\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Microsoft\Windows\AppCache\BDOU7LW5\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Microsoft\Windows\AppCache\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Microsoft\Windows\AppCache\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\20UHQLDA\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\20UHQLDA\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\8ED9LAB2\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\8ED9LAB2\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Microsoft\CryptnetUrlCache\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Microsoft\CryptnetUrlCache\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\0HYLUDRK\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\0HYLUDRK\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\R0Q1HA3Q\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\R0Q1HA3Q\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\U0051VM4\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\U0051VM4\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\L1K0JSJU\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\L1K0JSJU\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\PT9L5QVF\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\PT9L5QVF\help_restore_files_yddrf.txt
- %APPDATA%\Roaming\help_restore_files_yddrf.html
- %APPDATA%\Roaming\help_restore_files_yddrf.txt
- %HOMEPATH%\Contacts\help_restore_files_yddrf.html
- %HOMEPATH%\Contacts\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\help_restore_files_yddrf.html
- <LS_APPDATA>Low\help_restore_files_yddrf.txt
- %APPDATA%\help_restore_files_yddrf.html
- %APPDATA%\help_restore_files_yddrf.txt
- %HOMEPATH%\Pictures\help_restore_files_yddrf.html
- %HOMEPATH%\Pictures\help_restore_files_yddrf.txt
- %HOMEPATH%\Videos\help_restore_files_yddrf.html
- %HOMEPATH%\Videos\help_restore_files_yddrf.txt
- %APPDATA%\Roaming\Microsoft\Windows\Cookies\help_restore_files_yddrf.html
- %APPDATA%\Roaming\Microsoft\Windows\Cookies\help_restore_files_yddrf.txt
- %HOMEPATH%\Music\help_restore_files_yddrf.html
- %HOMEPATH%\Music\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Sun\Java\Deployment\tmp\si\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Sun\Java\Deployment\tmp\si\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Sun\Java\Deployment\tmp\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Sun\Java\Deployment\tmp\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Sun\Java\AU\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Sun\Java\AU\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Sun\Java\Deployment\security\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Sun\Java\Deployment\security\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Sun\Java\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Sun\Java\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Sun\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Sun\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Sun\Java\Deployment\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Sun\Java\Deployment\help_restore_files_yddrf.txt
- <LS_APPDATA>Low\Sun\Java\jre1.8.0_11\help_restore_files_yddrf.html
- <LS_APPDATA>Low\Sun\Java\jre1.8.0_11\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\MF\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\MF\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\IlsCache\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\IlsCache\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Media Player\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Media Player\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Network\Downloader\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Network\Downloader\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Network\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Network\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\NetFramework\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\NetFramework\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Network\Connections\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Network\Connections\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\DeviceSync\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\DeviceSync\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\DRM\Server\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\DRM\Server\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Device Stage\Task\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Device Stage\Task\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Device Stage\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Device Stage\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\eHome\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\eHome\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\IdentityCRL\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\IdentityCRL\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\DRM\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\DRM\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\eHome\logs\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\eHome\logs\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Search\Data\Applications\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\RAC\StateData\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\RAC\StateData\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\RAC\Temp\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\RAC\Temp\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\RAC\Outbound\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\RAC\Outbound\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\RAC\PublishedData\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\RAC\PublishedData\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\RAC\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\RAC\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Config\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Config\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\help_restore_files_yddrf.html
- C:\totalcmd\help_restore_files_yddrf.txt
- C:\totalcmd\LANGUAGE\help_restore_files_yddrf.html
- C:\ProgramData\help_restore_files_yddrf.txt
- C:\totalcmd\help_restore_files_yddrf.html
- C:\Recovery\help_restore_files_yddrf.html
- C:\Recovery\help_restore_files_yddrf.txt
- C:\totalcmd\LANGUAGE\help_restore_files_yddrf.txt
- <Auxiliary element>
- C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\help_restore_files_yddrf.txt
- C:\Users\Public\Favorites\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Assistance\Client\1.0\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\help_restore_files_yddrf.html
- C:\Users\Public\Documents\help_restore_files_yddrf.txt
- C:\ProgramData\help_restore_files_yddrf.html
- C:\Users\Public\Favorites\help_restore_files_yddrf.txt
- C:\Users\Public\Documents\help_restore_files_yddrf.html
- C:\$Recycle.Bin\help_restore_files_yddrf.html
- C:\$Recycle.Bin\help_restore_files_yddrf.txt
- <Current directory>\help_restore_files_yddrf.html
- <Current directory>\help_restore_files_yddrf.txt
- %HOMEPATH%\Documents\RECOVERY_FILE.TXT
- %APPDATA%\Roaming\svcvtb.exe
- C:\$Recycle.Bin\S-1-5-21-2832440558-3064306045-1455513625-1000\help_restore_files_yddrf.html
- C:\$Recycle.Bin\S-1-5-21-2832440558-3064306045-1455513625-1000\help_restore_files_yddrf.txt
- C:\PerfLogs\help_restore_files_yddrf.html
- C:\PerfLogs\help_restore_files_yddrf.txt
- C:\Recovery\1f81b231-1de2-11e4-b170-f6484b474a13\help_restore_files_yddrf.html
- C:\Recovery\1f81b231-1de2-11e4-b170-f6484b474a13\help_restore_files_yddrf.txt
- C:\Users\help_restore_files_yddrf.html
- C:\Users\help_restore_files_yddrf.txt
- C:\PerfLogs\Admin\help_restore_files_yddrf.html
- C:\PerfLogs\Admin\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Device Stage\Device\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Crypto\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Crypto\RSA\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Crypto\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Device Stage\Device\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Assistance\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Crypto\DSS\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Assistance\Client\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Assistance\Client\1.0\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Assistance\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Assistance\Client\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Crypto\RSA\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Crypto\Keys\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Crypto\DSS\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Crypto\Keys\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_30b340eb8e02812f59aa5726f432f9eb8f4453d_05d6c428\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_vcredist.exe_d9a1e9f8957f63aeacd7527a3c66aa52491cfb82_cab_097b4098\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_30b340eb8e02812f59aa5726f432f9eb8f4453d_cab_04570da6\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_30b340eb8e02812f59aa5726f432f9eb8f4453d_05d6c428\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_vc6redistsetup_e_81f683eaf25a5eb65b84b6ead9f13c45a48e7d43_cab_097aefca\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_7.6.7600.256_fa9f59c145989d6f0b41711f5b2db0e982417_cab_06aa7c03\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_vcredist.exe_d9a1e9f8957f63aeacd7527a3c66aa52491cfb82_cab_097b4098\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_vc6redistsetup_e_81f683eaf25a5eb65b84b6ead9f13c45a48e7d43_cab_097aefca\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\WER\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\WER\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_f798d2f057d38094f597ee5b2ac850417ab4a15d_cab_06ed1b9a\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_30b340eb8e02812f59aa5726f432f9eb8f4453d_cab_04570da6\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_f798d2f057d38094f597ee5b2ac850417ab4a15d_cab_06ed1b9a\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Total Commander\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Total Commander\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\WER\ReportArchive\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Templates\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_7.6.7600.256_fa9f59c145989d6f0b41711f5b2db0e982417_cab_06aa7c03\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportArchive\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Templates\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows Defender\Scans\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{530E0921-A5E7-41DC-809D-0892C07A16A6}\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{530E0921-A5E7-41DC-809D-0892C07A16A6}\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows Defender\Quarantine\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows Defender\LocalCopy\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows Defender\Quarantine\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows Defender\LocalCopy\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\DRM\Cache\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\DRM\Cache\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\DRM\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\DRM\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\DeviceMetadataStore\en-US\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\DeviceMetadataStore\en-US\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\DeviceMetadataStore\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\DeviceMetadataStore\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Ringtones\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Ringtones\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Sqm\Manifest\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Sqm\Manifest\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\GameExplorer\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\GameExplorer\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Search\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Search\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Search\Data\Temp\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Search\Data\Temp\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Search\Data\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Search\Data\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\AIT\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\AIT\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Caches\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Caches\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\User Account Pictures\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\User Account Pictures\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Vault\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Vault\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Far Manager 3\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Far Manager 3\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QIP 2012\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QIP 2012\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Sqm\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Sqm\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Sqm\Sessions\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Sqm\Sessions\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Sqm\Upload\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Sqm\Upload\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\help_restore_files_yddrf.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\help_restore_files_yddrf.html
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\help_restore_files_yddrf.txt
Deletes itself.
Network activity:
UDP:
- DNS ASK vm#######e8s.awsfdmn342ned.com
- DNS ASK dj#########z4nzx.tor2web.blutmagie.de
- DNS ASK dj#######2kz4nzx.tor2web.org
- DNS ASK ip##fo.io
- DNS ASK dn#.##ftncsi.com
- DNS ASK go########iuasdf7.l5news9ndbe3f.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''