Trojan.Siggen32.5580

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\MANC] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\MANC] 'ImagePath' = '<SYSTEM32>\MANC.exe'

Creates the following services

'MANC' <SYSTEM32>\MANC.exe

Modifies file system

Creates the following files

C:\log\В°ВІГ—В°.log
%TEMP%\ytsysconfig.ini
C:\install\000dffbd
C:\install\0004c8d9
C:\install\setuptool.exe
%WINDIR%\syswow64\msres\tools\setuptool.exe
C:\log\setupfirstrun.log
C:\install\32.bat
%WINDIR%\syswow64\msres\32.bat
C:\install\64.bat
%WINDIR%\syswow64\msres\64.bat
C:\install\7z.dll
%WINDIR%\syswow64\msres\7z.dll
C:\install\7z.exe
%WINDIR%\syswow64\msres\7z.exe
C:\install\7zsd.sfx
%WINDIR%\syswow64\msres\7zsd.sfx
C:\install\8021xclient.dll
%WINDIR%\syswow64\msres\8021xclient.dll
C:\install\adobase.dll
%WINDIR%\syswow64\msres\adobase.dll
C:\install\ansidll.dll
%WINDIR%\syswow64\msres\ansidll.dll
C:\install\assistantthc.dll
%WINDIR%\syswow64\msres\assistantthc.dll
C:\install\auditorviewwaitlist.exe
%WINDIR%\syswow64\msres\auditorviewwaitlist.exe
C:\install\avcodec-57.dll
%WINDIR%\syswow64\msres\avcodec-57.dll
C:\install\avdevice-57.dll
%WINDIR%\syswow64\msres\avdevice-57.dll
C:\install\avfilter-6.dll
%WINDIR%\syswow64\msres\avfilter-6.dll
C:\install\avformat-57.dll
%WINDIR%\syswow64\msres\avformat-57.dll
C:\install\avutil-55.dll
%WINDIR%\syswow64\msres\avutil-55.dll
C:\install\beginlog.bat
%WINDIR%\syswow64\msres\beginlog.bat
C:\install\change.dll
%WINDIR%\syswow64\msres\change.dll
C:\install\chi_sim.traineddata
%WINDIR%\syswow64\msres\chi_sim.traineddata
C:\install\cj60lib.dll
%WINDIR%\syswow64\msres\cj60lib.dll
C:\install\cleanpermissions.bat
%WINDIR%\syswow64\msres\cleanpermissions.bat
C:\install\clienttool.exe
%WINDIR%\syswow64\msres\clienttool.exe
C:\install\comfun.dll
%WINDIR%\syswow64\msres\comfun.dll
C:\install\chatrecord.db
%WINDIR%\syswow64\msres\config\chatrecord.db
C:\install\riben.ytf
%WINDIR%\syswow64\msres\config\riben.ytf
C:\install\scanauditdb.db
%WINDIR%\syswow64\msres\config\scanauditdb.db
C:\install\scanfulldb.db
%WINDIR%\syswow64\msres\config\scanfulldb.db
C:\install\desktopduplication.dll
%WINDIR%\syswow64\msres\desktopduplication.dll
C:\install\devicemanage.dll
%WINDIR%\syswow64\msres\devicemanage.dll
C:\install\encryptgui.exe
%WINDIR%\syswow64\msres\encryptgui.exe
C:\install\excelfundll.dll
%WINDIR%\syswow64\msres\excelfundll.dll
C:\install\exit.bat
%WINDIR%\syswow64\msres\exit.bat
C:\install\fileencrypt.dll
%WINDIR%\syswow64\msres\fileencrypt.dll
C:\install\filetransport.dll
%WINDIR%\syswow64\msres\filetransport.dll
C:\install\fsconfig.ytf
%WINDIR%\syswow64\msres\fsconfig.ytf
C:\install\fshost32.exe
%WINDIR%\syswow64\msres\fshost32.exe
C:\install\fshost64.exe
%WINDIR%\syswow64\msres\fshost64.exe
C:\install\genewm.exe
%WINDIR%\syswow64\msres\genewm.exe
C:\install\gfunlib32.dll
%WINDIR%\syswow64\msres\gfunlib32.dll
C:\install\gfunlib64.dll
%WINDIR%\syswow64\msres\gfunlib64.dll
C:\install\globaluserctrl32.dll
%WINDIR%\syswow64\msres\globaluserctrl32.dll
C:\install\globaluserctrl64.dll
%WINDIR%\syswow64\msres\globaluserctrl64.dll
C:\install\gui.dll
%WINDIR%\syswow64\msres\gui.dll
C:\install\help.bat
%WINDIR%\syswow64\msres\help.bat
C:\install\helpformat.bat
%WINDIR%\syswow64\msres\helpformat.bat
C:\install\hkforbit.dll
%WINDIR%\syswow64\msres\hkforbit.dll
C:\install\hksock32.dll
%WINDIR%\syswow64\msres\hksock32.dll
C:\install\hksock64.dll
%WINDIR%\syswow64\msres\hksock64.dll
C:\install\icontray.ico
%WINDIR%\syswow64\msres\icontray.ico
C:\install\ijl15.dll
%WINDIR%\syswow64\msres\ijl15.dll
C:\install\imagelib.dll
%WINDIR%\syswow64\msres\imagelib.dll
C:\install\imageocr.dll
%WINDIR%\syswow64\msres\imageocr.dll
C:\install\injectdll32.exe
%WINDIR%\syswow64\msres\injectdll32.exe
C:\install\installex.exe
%WINDIR%\syswow64\msres\installex.exe
C:\install\itp.ytf
%WINDIR%\syswow64\msres\itp.ytf
C:\install\english.ytf
%WINDIR%\syswow64\msres\language\english.ytf
C:\install\lanmap.dll
%WINDIR%\syswow64\msres\lanmap.dll
C:\install\libeay32.dll
%WINDIR%\syswow64\msres\libeay32.dll
C:\install\libsedisk.dll
%WINDIR%\syswow64\msres\libsedisk.dll
C:\install\local.ini
%WINDIR%\syswow64\msres\local.ini
C:\install\manc.exe
%WINDIR%\syswow64\manc.exe
C:\install\mfc140u.dll
%WINDIR%\syswow64\msres\mfc140u.dll
C:\install\mframe.dll
%WINDIR%\syswow64\msres\mframe.dll
C:\install\msch.dll
%WINDIR%\syswow64\msres\msch.dll
C:\install\msch64.dll
%WINDIR%\syswow64\msres\msch64.dll
C:\install\msgtrack.dll
%WINDIR%\syswow64\msgtrack.dll
C:\install\mspm32.dll
%WINDIR%\syswow64\msres\mspm32.dll
C:\install\mspm64.dll
%WINDIR%\syswow64\msres\mspm64.dll
C:\install\msproc.dll
%WINDIR%\syswow64\msres\msproc.dll
C:\install\netbase.dll
%WINDIR%\syswow64\msres\netbase.dll
C:\install\netclass.dll
%WINDIR%\syswow64\msres\netclass.dll
C:\install\netconfig.ytf
%WINDIR%\syswow64\msres\netconfig.ytf
C:\install\netft.sys
%WINDIR%\syswow64\msres\netft.sys
C:\install\netftxp.sys
%WINDIR%\syswow64\msres\netftxp.sys
C:\install\netjmfile32.dll
%WINDIR%\syswow64\msres\netjmfile32.dll
C:\install\netjmfile64.dll
%WINDIR%\syswow64\msres\netjmfile64.dll
C:\install\nettran.dll
%WINDIR%\syswow64\msres\nettran.dll
C:\install\netw.ytf
%WINDIR%\syswow64\msres\netw.ytf
C:\install\newicon.ico
%WINDIR%\syswow64\msres\newicon.ico
C:\install\newlockdesk.dll
%WINDIR%\syswow64\msres\newlockdesk.dll
C:\install\newuishortcut.exe
%WINDIR%\syswow64\msres\newuishortcut.exe
C:\install\nfapi.dll
%WINDIR%\syswow64\msres\nfapi.dll
C:\install\packetupdate.dll
%WINDIR%\syswow64\msres\packetupdate.dll
C:\install\paraset.ytf
%WINDIR%\syswow64\msres\paraset.ytf
C:\install\postproc-54.dll
%WINDIR%\syswow64\msres\postproc-54.dll
C:\install\procmon.sys
%WINDIR%\syswow64\procmon.sys
C:\install\procw.ytf
%WINDIR%\syswow64\msres\procw.ytf
C:\install\detection.dll
%WINDIR%\syswow64\msres\protect\detection.dll
C:\install\detection.ini
%WINDIR%\syswow64\msres\protect\detection.ini
C:\install\fadisk.sys
%WINDIR%\syswow64\msres\protect\fadisk.sys
C:\install\fadisk_x64.sys
%WINDIR%\syswow64\msres\protect\fadisk_x64.sys
C:\install\fastmnt.dll
%WINDIR%\syswow64\msres\protect\fastmnt.dll
C:\install\fastmnt.sys
%WINDIR%\syswow64\msres\protect\fastmnt.sys
C:\install\fastmnt_x64.sys
%WINDIR%\syswow64\msres\protect\fastmnt_x64.sys
C:\install\frsdk.dll
%WINDIR%\syswow64\msres\protect\frsdk.dll
C:\install\frsdk.ini
%WINDIR%\syswow64\msres\protect\frsdk.ini
C:\install\frsdktest-2020.10.14 bak.exe
%WINDIR%\syswow64\msres\protect\frsdktest-2020.10.14 bak.exe
C:\install\frsdktest.exe
%WINDIR%\syswow64\msres\protect\frsdktest.exe
C:\install\license.txt
%WINDIR%\syswow64\msres\protect\license.txt
C:\install\readme.txt
%WINDIR%\syswow64\msres\protect\readme.txt
C:\install\restore.dll
%WINDIR%\syswow64\msres\protect\restore.dll
C:\install\rstdata.bin
%WINDIR%\syswow64\msres\protect\rstdata.bin
C:\install\stdmbr.bin
%WINDIR%\syswow64\msres\protect\stdmbr.bin
C:\install\protocolfilters.dll
%WINDIR%\syswow64\msres\protocolfilters.dll
C:\install\rar.exe
%WINDIR%\syswow64\msres\rar.exe
C:\install\rdf.ytf
%WINDIR%\syswow64\msres\rdf.ytf
C:\install\rdt.ytf
%WINDIR%\syswow64\msres\rdt.ytf
C:\install\restorekrl.dll
%WINDIR%\syswow64\msres\restorekrl.dll
C:\install\safeport.ytf
%WINDIR%\syswow64\msres\safeport.ytf
C:\install\scanofficedll.dll
%WINDIR%\syswow64\msres\scanofficedll.dll
C:\install\screenlock.bmp
%WINDIR%\syswow64\msres\screenlock.bmp
C:\install\screenlock.exe
%WINDIR%\syswow64\msres\screenlock.exe
C:\install\scw32.dll
%WINDIR%\syswow64\msres\scw32.dll
C:\install\scw64.dll
%WINDIR%\syswow64\msres\scw64.dll
C:\install\scwnew.dll
%WINDIR%\syswow64\msres\scwnew.dll
C:\install\sedisk.sys
%WINDIR%\syswow64\msres\sedisk.sys
C:\install\sedisk64.sys
%WINDIR%\syswow64\msres\sedisk64.sys
C:\install\setpermissions.bat
%WINDIR%\syswow64\msres\setpermissions.bat
C:\install\setup.exe
%WINDIR%\syswow64\msres\setup.exe
C:\install\sgfp.sys
%WINDIR%\syswow64\msres\sgfp.sys
C:\install\bk.png
%WINDIR%\syswow64\msres\skin\background\bk.png
C:\install\cancel.png
%WINDIR%\syswow64\msres\skin\background\cancel.png
C:\install\cancel1.png
%WINDIR%\syswow64\msres\skin\background\cancel1.png
C:\install\cancel2.png
%WINDIR%\syswow64\msres\skin\background\cancel2.png
C:\install\cwts_03.bmp
%WINDIR%\syswow64\msres\skin\background\cwts_03.bmp
C:\install\depsel.png
%WINDIR%\syswow64\msres\skin\background\depsel.png
C:\install\depsel1.png
%WINDIR%\syswow64\msres\skin\background\depsel1.png
C:\install\dh2_01.png
%WINDIR%\syswow64\msres\skin\background\images\dh2_01.png
C:\install\dh_01.png
%WINDIR%\syswow64\msres\skin\background\images\dh_01.png
C:\install\doc.png
%WINDIR%\syswow64\msres\skin\background\images\doc.png
C:\install\down.png
%WINDIR%\syswow64\msres\skin\background\images\down.png
C:\install\fswj_01.png
%WINDIR%\syswow64\msres\skin\background\images\fswj_01.png
C:\install\fswj_02.png
%WINDIR%\syswow64\msres\skin\background\images\fswj_02.png
C:\install\fswj_03.png
%WINDIR%\syswow64\msres\skin\background\images\fswj_03.png
C:\install\gwxz.png
%WINDIR%\syswow64\msres\skin\background\images\gwxz.png
C:\install\gxz.png
%WINDIR%\syswow64\msres\skin\background\images\gxz.png
C:\install\jpg.png
%WINDIR%\syswow64\msres\skin\background\images\jpg.png
C:\install\more.png
%WINDIR%\syswow64\msres\skin\background\images\more.png
C:\install\pdf.png
%WINDIR%\syswow64\msres\skin\background\images\pdf.png
C:\install\ppt.png
%WINDIR%\syswow64\msres\skin\background\images\ppt.png
C:\install\qdan_01.png
%WINDIR%\syswow64\msres\skin\background\images\qdan_01.png
C:\install\qdan_02.png
%WINDIR%\syswow64\msres\skin\background\images\qdan_02.png
C:\install\qdan_03.png
%WINDIR%\syswow64\msres\skin\background\images\qdan_03.png
C:\install\qxan2_09.png
%WINDIR%\syswow64\msres\skin\background\images\qxan2_09.png
C:\install\qxan3_09.png
%WINDIR%\syswow64\msres\skin\background\images\qxan3_09.png
C:\install\sc.png
%WINDIR%\syswow64\msres\skin\background\images\sc.png
C:\install\scyp_01.png
%WINDIR%\syswow64\msres\skin\background\images\scyp_01.png
C:\install\scyp_02.png
%WINDIR%\syswow64\msres\skin\background\images\scyp_02.png
C:\install\scyp_03.png
%WINDIR%\syswow64\msres\skin\background\images\scyp_03.png
C:\install\ss.png
%WINDIR%\syswow64\msres\skin\background\images\ss.png
C:\install\sx_01.png
%WINDIR%\syswow64\msres\skin\background\images\sx_01.png
C:\install\wjj.png
%WINDIR%\syswow64\msres\skin\background\images\wjj.png
C:\install\wj_01.png
%WINDIR%\syswow64\msres\skin\background\images\wj_01.png
C:\install\wp.png
%WINDIR%\syswow64\msres\skin\background\images\wp.png
C:\install\xk_01.png
%WINDIR%\syswow64\msres\skin\background\images\xk_01.png
C:\install\xk_02.png
%WINDIR%\syswow64\msres\skin\background\images\xk_02.png
C:\install\xk_03.png
%WINDIR%\syswow64\msres\skin\background\images\xk_03.png
C:\install\xx.bmp
%WINDIR%\syswow64\msres\skin\background\images\xx.bmp
C:\install\xx.png
%WINDIR%\syswow64\msres\skin\background\images\xx.png
C:\install\xz.png
%WINDIR%\syswow64\msres\skin\background\images\xz.png
C:\install\yp.png
%WINDIR%\syswow64\msres\skin\background\images\yp.png
C:\install\zip.png
%WINDIR%\syswow64\msres\skin\background\images\zip.png
C:\install\pack_bg.bmp
%WINDIR%\syswow64\msres\skin\background\pack_bg.bmp
C:\install\pack_head1.bmp
%WINDIR%\syswow64\msres\skin\background\pack_head1.bmp
C:\install\pack_head2.bmp
%WINDIR%\syswow64\msres\skin\background\pack_head2.bmp
C:\install\seachnone.bmp
%WINDIR%\syswow64\msres\skin\background\seachnone.bmp
C:\install\search.bmp
%WINDIR%\syswow64\msres\skin\background\search.bmp
C:\install\upload.png
%WINDIR%\syswow64\msres\skin\background\upload.png
C:\install\userchange_bk.bmp
%WINDIR%\syswow64\msres\skin\background\userchange_bk.bmp
C:\install\userreg.png
%WINDIR%\syswow64\msres\skin\background\userreg.png
C:\install\userreg001.png
%WINDIR%\syswow64\msres\skin\background\userreg001.png
C:\install\userreg002.png
%WINDIR%\syswow64\msres\skin\background\userreg002.png
C:\install\userreg2.png
%WINDIR%\syswow64\msres\skin\background\userreg2.png
C:\install\userreg3.png
%WINDIR%\syswow64\msres\skin\background\userreg3.png
C:\install\bk123.jpg
%WINDIR%\syswow64\msres\skin\bk\bk123.jpg
C:\install\bk_assist.png
%WINDIR%\syswow64\msres\skin\bk\bk_assist.png
C:\install\mapbg.png
%WINDIR%\syswow64\msres\skin\bk\mapbg.png
C:\install\patch_repairall_bk.png
%WINDIR%\syswow64\msres\skin\bk\patch_repairall_bk.png
C:\install\patch_repairall_bk_clicked.png
%WINDIR%\syswow64\msres\skin\bk\patch_repairall_bk_clicked.png
C:\install\topbg.jpg
%WINDIR%\syswow64\msres\skin\bk\topbg.jpg
C:\install\btnclose.bmp
%WINDIR%\syswow64\msres\skin\btn\btnclose.bmp
C:\install\btnclose1.bmp
%WINDIR%\syswow64\msres\skin\btn\btnclose1.bmp
C:\install\btnclose2.bmp
%WINDIR%\syswow64\msres\skin\btn\btnclose2.bmp
C:\install\btnclose3.bmp
%WINDIR%\syswow64\msres\skin\btn\btnclose3.bmp
C:\install\btnmin.bmp
%WINDIR%\syswow64\msres\skin\btn\btnmin.bmp
C:\install\btnmin1.bmp
%WINDIR%\syswow64\msres\skin\btn\btnmin1.bmp
C:\install\btnmin2.bmp
%WINDIR%\syswow64\msres\skin\btn\btnmin2.bmp
C:\install\btnmin3.bmp
%WINDIR%\syswow64\msres\skin\btn\btnmin3.bmp
C:\install\btnuser.bmp
%WINDIR%\syswow64\msres\skin\btn\btnuser.bmp
C:\install\circul1.bmp
%WINDIR%\syswow64\msres\skin\btn\circul1.bmp
C:\install\circul2.bmp
%WINDIR%\syswow64\msres\skin\btn\circul2.bmp
C:\install\clientlogo.png
%WINDIR%\syswow64\msres\skin\btn\clientlogo.png
C:\install\close1.bmp
%WINDIR%\syswow64\msres\skin\btn\close1.bmp
C:\install\close2.bmp
%WINDIR%\syswow64\msres\skin\btn\close2.bmp
C:\install\close_03.png
%WINDIR%\syswow64\msres\skin\btn\close_03.png
C:\install\close_05.png
%WINDIR%\syswow64\msres\skin\btn\close_05.png
C:\install\close_1.bmp
%WINDIR%\syswow64\msres\skin\btn\close_1.bmp
C:\install\close_user.png
%WINDIR%\syswow64\msres\skin\btn\close_user.png
C:\install\close_user1.png
%WINDIR%\syswow64\msres\skin\btn\close_user1.png
C:\install\commit0.png
%WINDIR%\syswow64\msres\skin\btn\commit0.png
C:\install\dengji.png
%WINDIR%\syswow64\msres\skin\btn\dengji.png
C:\install\down.bmp
%WINDIR%\syswow64\msres\skin\btn\down.bmp
C:\install\down1.bmp
%WINDIR%\syswow64\msres\skin\btn\down1.bmp
C:\install\down2.bmp
%WINDIR%\syswow64\msres\skin\btn\down2.bmp
C:\install\gb_01.png
%WINDIR%\syswow64\msres\skin\btn\gb_01.png
C:\install\gb_02.png
%WINDIR%\syswow64\msres\skin\btn\gb_02.png
C:\install\gb_03.png
%WINDIR%\syswow64\msres\skin\btn\gb_03.png
C:\install\gx_01.bmp
%WINDIR%\syswow64\msres\skin\btn\gx_01.bmp
C:\install\gx_02.bmp
%WINDIR%\syswow64\msres\skin\btn\gx_02.bmp
C:\install\head_03.jpg
%WINDIR%\syswow64\msres\skin\btn\head_03.jpg
C:\install\min.bmp
%WINDIR%\syswow64\msres\skin\btn\min.bmp
C:\install\myfix.bmp
%WINDIR%\syswow64\msres\skin\btn\myfix.bmp
C:\install\myfix_2.bmp
%WINDIR%\syswow64\msres\skin\btn\myfix_2.bmp
C:\install\ok.png
%WINDIR%\syswow64\msres\skin\btn\ok.png
C:\install\open_03_01.png
%WINDIR%\syswow64\msres\skin\btn\open_03_01.png
C:\install\open_03_02.png
%WINDIR%\syswow64\msres\skin\btn\open_03_02.png
C:\install\open_03_03.png
%WINDIR%\syswow64\msres\skin\btn\open_03_03.png
C:\install\patch-win-icon.png
%WINDIR%\syswow64\msres\skin\btn\patch-win-icon.png
C:\install\patchbuttoncancel.png
%WINDIR%\syswow64\msres\skin\btn\patchbuttoncancel.png
C:\install\patchbuttoncancel2.png
%WINDIR%\syswow64\msres\skin\btn\patchbuttoncancel2.png
C:\install\patchinfo.png
%WINDIR%\syswow64\msres\skin\btn\patchinfo.png
C:\install\patchquery.png
%WINDIR%\syswow64\msres\skin\btn\patchquery.png
C:\install\patchquery2.png
%WINDIR%\syswow64\msres\skin\btn\patchquery2.png
C:\install\patch_cancel1.png
%WINDIR%\syswow64\msres\skin\btn\patch_cancel1.png
C:\install\patch_cancel2.png
%WINDIR%\syswow64\msres\skin\btn\patch_cancel2.png
C:\install\patch_icon_first.png
%WINDIR%\syswow64\msres\skin\btn\patch_icon_first.png
C:\install\patch_icon_left.png
%WINDIR%\syswow64\msres\skin\btn\patch_icon_left.png
C:\install\patch_icon_left2.png
%WINDIR%\syswow64\msres\skin\btn\patch_icon_left2.png
C:\install\preview1.bmp
%WINDIR%\syswow64\msres\skin\btn\preview1.bmp
C:\install\preview2.bmp
%WINDIR%\syswow64\msres\skin\btn\preview2.bmp
C:\install\qhdl_01.bmp
%WINDIR%\syswow64\msres\skin\btn\qhdl_01.bmp
C:\install\qhdl_02.bmp
%WINDIR%\syswow64\msres\skin\btn\qhdl_02.bmp
C:\install\qhdl_03.bmp
%WINDIR%\syswow64\msres\skin\btn\qhdl_03.bmp
C:\install\qhdl_04.bmp
%WINDIR%\syswow64\msres\skin\btn\qhdl_04.bmp
C:\install\refreshbt_1.bmp
%WINDIR%\syswow64\msres\skin\btn\refreshbt_1.bmp
C:\install\repair.bmp
%WINDIR%\syswow64\msres\skin\btn\repair.bmp
C:\install\repair2.bmp
%WINDIR%\syswow64\msres\skin\btn\repair2.bmp
C:\install\repairall.png
%WINDIR%\syswow64\msres\skin\btn\repairall.png
C:\install\repairall2.png
%WINDIR%\syswow64\msres\skin\btn\repairall2.png
C:\install\select_all.bmp
%WINDIR%\syswow64\msres\skin\btn\select_all.bmp
C:\install\select_all2.bmp
%WINDIR%\syswow64\msres\skin\btn\select_all2.bmp
C:\install\select_fan.bmp
%WINDIR%\syswow64\msres\skin\btn\select_fan.bmp
C:\install\select_fan2.bmp
%WINDIR%\syswow64\msres\skin\btn\select_fan2.bmp
C:\install\sendbt_1.bmp
%WINDIR%\syswow64\msres\skin\btn\sendbt_1.bmp
C:\install\sendbt_2.bmp
%WINDIR%\syswow64\msres\skin\btn\sendbt_2.bmp
C:\install\sendbt_3.bmp
%WINDIR%\syswow64\msres\skin\btn\sendbt_3.bmp
%WINDIR%\syswow64\msres\skin\btn\sx_01.png
C:\install\sx_02.png
%WINDIR%\syswow64\msres\skin\btn\sx_02.png
C:\install\sx_03.png
%WINDIR%\syswow64\msres\skin\btn\sx_03.png
C:\install\sz_01.png
%WINDIR%\syswow64\msres\skin\btn\sz_01.png
C:\install\sz_02.png
%WINDIR%\syswow64\msres\skin\btn\sz_02.png
C:\install\sz_03.png
%WINDIR%\syswow64\msres\skin\btn\sz_03.png
C:\install\up.bmp
%WINDIR%\syswow64\msres\skin\btn\up.bmp
C:\install\uploadbt_1.bmp
%WINDIR%\syswow64\msres\skin\btn\uploadbt_1.bmp
C:\install\uploadbt_2.bmp
%WINDIR%\syswow64\msres\skin\btn\uploadbt_2.bmp
C:\install\uploadbt_3.bmp
%WINDIR%\syswow64\msres\skin\btn\uploadbt_3.bmp
C:\install\userchange_01.bmp
%WINDIR%\syswow64\msres\skin\btn\userchange_01.bmp
C:\install\userchange_02.bmp
%WINDIR%\syswow64\msres\skin\btn\userchange_02.bmp
C:\install\userchange_03.bmp
%WINDIR%\syswow64\msres\skin\btn\userchange_03.bmp
C:\install\userregclose.png
%WINDIR%\syswow64\msres\skin\btn\userregclose.png
C:\install\xuan0.png
%WINDIR%\syswow64\msres\skin\btn\xuan0.png
C:\install\xx_01.bmp
%WINDIR%\syswow64\msres\skin\btn\xx_01.bmp
C:\install\xx_02.bmp
%WINDIR%\syswow64\msres\skin\btn\xx_02.bmp
C:\install\xx_03.bmp
%WINDIR%\syswow64\msres\skin\btn\xx_03.bmp
C:\install\yj_01.bmp
%WINDIR%\syswow64\msres\skin\btn\yj_01.bmp
C:\install\yj_02.bmp
%WINDIR%\syswow64\msres\skin\btn\yj_02.bmp
C:\install\zhuce.png
%WINDIR%\syswow64\msres\skin\btn\zhuce.png
C:\install\box_1.bmp
%WINDIR%\syswow64\msres\skin\dlp\box_1.bmp
C:\install\box_2.bmp
%WINDIR%\syswow64\msres\skin\dlp\box_2.bmp
C:\install\box_3.bmp
%WINDIR%\syswow64\msres\skin\dlp\box_3.bmp
C:\install\dir.bmp
%WINDIR%\syswow64\msres\skin\dlp\dir.bmp
C:\install\dir_bk.bmp
%WINDIR%\syswow64\msres\skin\dlp\dir_bk.bmp
C:\install\dir_splite.bmp
%WINDIR%\syswow64\msres\skin\dlp\dir_splite.bmp
C:\install\doc.bmp
%WINDIR%\syswow64\msres\skin\dlp\doc.bmp
%WINDIR%\syswow64\msres\skin\dlp\down.bmp
C:\install\jpg.bmp
%WINDIR%\syswow64\msres\skin\dlp\jpg.bmp
C:\install\pdf.bmp
%WINDIR%\syswow64\msres\skin\dlp\pdf.bmp
C:\install\ppt.bmp
%WINDIR%\syswow64\msres\skin\dlp\ppt.bmp
C:\install\safedisk.bmp
%WINDIR%\syswow64\msres\skin\dlp\safedisk.bmp
%WINDIR%\syswow64\msres\skin\dlp\search.bmp
C:\install\wjj.bmp
%WINDIR%\syswow64\msres\skin\dlp\wjj.bmp
C:\install\yundisk.bmp
%WINDIR%\syswow64\msres\skin\dlp\yundisk.bmp
C:\install\chat.png
%WINDIR%\syswow64\msres\skin\icon\chat.png
C:\install\chat_1.png
%WINDIR%\syswow64\msres\skin\icon\chat_1.png
C:\install\gx01.png
%WINDIR%\syswow64\msres\skin\icon\gx01.png
C:\install\ico1.png
%WINDIR%\syswow64\msres\skin\icon\ico1.png
C:\install\ico2.png
%WINDIR%\syswow64\msres\skin\icon\ico2.png
C:\install\ico3.png
%WINDIR%\syswow64\msres\skin\icon\ico3.png
C:\install\ico4.png
%WINDIR%\syswow64\msres\skin\icon\ico4.png
C:\install\ico5.png
%WINDIR%\syswow64\msres\skin\icon\ico5.png
C:\install\ico6.png
%WINDIR%\syswow64\msres\skin\icon\ico6.png
C:\install\ico7.png
%WINDIR%\syswow64\msres\skin\icon\ico7.png
C:\install\ico_force.png
%WINDIR%\syswow64\msres\skin\icon\ico_force.png
C:\install\ico_ture.png
%WINDIR%\syswow64\msres\skin\icon\ico_ture.png
C:\install\jzai.gif
%WINDIR%\syswow64\msres\skin\icon\jzai.gif
C:\install\p0.png
%WINDIR%\syswow64\msres\skin\icon\p0.png
C:\install\p0_1.png
%WINDIR%\syswow64\msres\skin\icon\p0_1.png
C:\install\p1.png
%WINDIR%\syswow64\msres\skin\icon\p1.png
C:\install\p1_1.png
%WINDIR%\syswow64\msres\skin\icon\p1_1.png
C:\install\p2.png
%WINDIR%\syswow64\msres\skin\icon\p2.png
C:\install\p2_1.png
%WINDIR%\syswow64\msres\skin\icon\p2_1.png
C:\install\p3.png
%WINDIR%\syswow64\msres\skin\icon\p3.png
C:\install\p3_1.png
%WINDIR%\syswow64\msres\skin\icon\p3_1.png
C:\install\p4.png
%WINDIR%\syswow64\msres\skin\icon\p4.png
C:\install\p4_1.png
%WINDIR%\syswow64\msres\skin\icon\p4_1.png
C:\install\p5.png
%WINDIR%\syswow64\msres\skin\icon\p5.png
C:\install\p5_1.png
%WINDIR%\syswow64\msres\skin\icon\p5_1.png
C:\install\p6.png
%WINDIR%\syswow64\msres\skin\icon\p6.png
C:\install\p6_1.png
%WINDIR%\syswow64\msres\skin\icon\p6_1.png
C:\install\p7.png
%WINDIR%\syswow64\msres\skin\icon\p7.png
C:\install\p7_1.png
%WINDIR%\syswow64\msres\skin\icon\p7_1.png
C:\install\pnetdisk.png
%WINDIR%\syswow64\msres\skin\icon\pnetdisk.png
C:\install\pnetdisk_1.png
%WINDIR%\syswow64\msres\skin\icon\pnetdisk_1.png
C:\install\soft1.png
%WINDIR%\syswow64\msres\skin\icon\soft1.png
C:\install\up.png
%WINDIR%\syswow64\msres\skin\icon\up.png
C:\install\usmall.png
%WINDIR%\syswow64\msres\skin\icon\usmall.png
C:\install\wifi-no.png
%WINDIR%\syswow64\msres\skin\icon\wifi-no.png
C:\install\wifi.png
%WINDIR%\syswow64\msres\skin\icon\wifi.png
C:\install\activecaption.bmp
%WINDIR%\syswow64\msres\skin\riant\activecaption.bmp
C:\install\dialogbk.bmp
%WINDIR%\syswow64\msres\skin\riant\dialogbk.bmp
C:\install\exit_down.bmp
%WINDIR%\syswow64\msres\skin\riant\exit_down.bmp
C:\install\exit_foc.bmp
%WINDIR%\syswow64\msres\skin\riant\exit_foc.bmp
C:\install\exit_nor.bmp
%WINDIR%\syswow64\msres\skin\riant\exit_nor.bmp
C:\install\formviewbk.bmp
%WINDIR%\syswow64\msres\skin\riant\formviewbk.bmp
C:\install\frameborder.bmp
%WINDIR%\syswow64\msres\skin\riant\frameborder.bmp
C:\install\frametopborder.bmp
%WINDIR%\syswow64\msres\skin\riant\frametopborder.bmp
C:\install\headerctrlnormal.bmp
%WINDIR%\syswow64\msres\skin\riant\headerctrlnormal.bmp
C:\install\horizontalthumb.bmp
%WINDIR%\syswow64\msres\skin\riant\horizontalthumb.bmp
C:\install\inactivecaption.bmp
%WINDIR%\syswow64\msres\skin\riant\inactivecaption.bmp
C:\install\leftarrow.bmp
%WINDIR%\syswow64\msres\skin\riant\leftarrow.bmp
C:\install\max_down.bmp
%WINDIR%\syswow64\msres\skin\riant\max_down.bmp
C:\install\max_focu.bmp
%WINDIR%\syswow64\msres\skin\riant\max_focu.bmp
C:\install\max_norm.bmp
%WINDIR%\syswow64\msres\skin\riant\max_norm.bmp
C:\install\menudown.bmp
%WINDIR%\syswow64\msres\skin\riant\menudown.bmp
C:\install\menufocus.bmp
%WINDIR%\syswow64\msres\skin\riant\menufocus.bmp
C:\install\menuitemdown.bmp
%WINDIR%\syswow64\msres\skin\riant\menuitemdown.bmp
C:\install\min_down.bmp
%WINDIR%\syswow64\msres\skin\riant\min_down.bmp
C:\install\min_focu.bmp
%WINDIR%\syswow64\msres\skin\riant\min_focu.bmp
C:\install\min_norm.bmp
%WINDIR%\syswow64\msres\skin\riant\min_norm.bmp
C:\install\new-barexpand.bmp
%WINDIR%\syswow64\msres\skin\riant\new-barexpand.bmp
C:\install\new-btnleft.bmp
%WINDIR%\syswow64\msres\skin\riant\new-btnleft.bmp
C:\install\new-btnmid.bmp
%WINDIR%\syswow64\msres\skin\riant\new-btnmid.bmp
C:\install\new-btnright.bmp
%WINDIR%\syswow64\msres\skin\riant\new-btnright.bmp
C:\install\new-cancelbk.bmp
%WINDIR%\syswow64\msres\skin\riant\new-cancelbk.bmp
C:\install\new-exit_nor.bmp
%WINDIR%\syswow64\msres\skin\riant\new-exit_nor.bmp
C:\install\new-loginbodybk.bmp
%WINDIR%\syswow64\msres\skin\riant\new-loginbodybk.bmp
C:\install\new-logintitlebk.bmp
%WINDIR%\syswow64\msres\skin\riant\new-logintitlebk.bmp
C:\install\new-menubt.bmp
%WINDIR%\syswow64\msres\skin\riant\new-menubt.bmp
C:\install\new-menuitemback.bmp
%WINDIR%\syswow64\msres\skin\riant\new-menuitemback.bmp
C:\install\new-min_norm.bmp
%WINDIR%\syswow64\msres\skin\riant\new-min_norm.bmp
C:\install\new-okbk.bmp
%WINDIR%\syswow64\msres\skin\riant\new-okbk.bmp
C:\install\new-res_down.bmp
%WINDIR%\syswow64\msres\skin\riant\new-res_down.bmp
C:\install\new-tabheadbk.bmp
%WINDIR%\syswow64\msres\skin\riant\new-tabheadbk.bmp
C:\install\new-tabheadbtn.bmp
%WINDIR%\syswow64\msres\skin\riant\new-tabheadbtn.bmp
C:\install\res_down.bmp
%WINDIR%\syswow64\msres\skin\riant\res_down.bmp
C:\install\res_focu.bmp
%WINDIR%\syswow64\msres\skin\riant\res_focu.bmp
C:\install\res_norm.bmp
%WINDIR%\syswow64\msres\skin\riant\res_norm.bmp
C:\install\rightarrow.bmp
%WINDIR%\syswow64\msres\skin\riant\rightarrow.bmp
C:\install\scrollbarbk.bmp
%WINDIR%\syswow64\msres\skin\riant\scrollbarbk.bmp
C:\install\skin.ini
%WINDIR%\syswow64\msres\skin\riant\skin.ini
C:\install\tableft.bmp
%WINDIR%\syswow64\msres\skin\riant\tableft.bmp
C:\install\tableftsel.bmp
%WINDIR%\syswow64\msres\skin\riant\tableftsel.bmp
C:\install\tabmid.bmp
%WINDIR%\syswow64\msres\skin\riant\tabmid.bmp
C:\install\tabmidsel.bmp
%WINDIR%\syswow64\msres\skin\riant\tabmidsel.bmp
C:\install\tabright.bmp
%WINDIR%\syswow64\msres\skin\riant\tabright.bmp
C:\install\tabrightsel.bmp
%WINDIR%\syswow64\msres\skin\riant\tabrightsel.bmp
C:\install\toolbarback.bmp
%WINDIR%\syswow64\msres\skin\riant\toolbarback.bmp
C:\install\toolbarfocus.bmp
%WINDIR%\syswow64\msres\skin\riant\toolbarfocus.bmp
C:\install\viewbk.bmp
%WINDIR%\syswow64\msres\skin\riant\viewbk.bmp
C:\install\chatbtn.png
%WINDIR%\syswow64\msres\skin\riant2019\chatbtn.png
C:\install\chatbtnhold.png
%WINDIR%\syswow64\msres\skin\riant2019\chatbtnhold.png
C:\install\close.png
%WINDIR%\syswow64\msres\skin\riant2019\close.png
C:\install\closechoice.png
%WINDIR%\syswow64\msres\skin\riant2019\closechoice.png
C:\install\depbtn.png
%WINDIR%\syswow64\msres\skin\riant2019\depbtn.png
C:\install\depbtnhold.png
%WINDIR%\syswow64\msres\skin\riant2019\depbtnhold.png
%WINDIR%\syswow64\msres\skin\riant2019\qdan_01.png
%WINDIR%\syswow64\msres\skin\riant2019\qdan_02.png
%WINDIR%\syswow64\msres\skin\riant2019\qdan_03.png
C:\install\sendfile.png
%WINDIR%\syswow64\msres\skin\riant2019\sendfile.png
C:\install\sendfile1.png
%WINDIR%\syswow64\msres\skin\riant2019\sendfile1.png
C:\install\sendmsg.png
%WINDIR%\syswow64\msres\skin\riant2019\sendmsg.png
C:\install\sendmsg1.png
%WINDIR%\syswow64\msres\skin\riant2019\sendmsg1.png
C:\install\small.png
%WINDIR%\syswow64\msres\skin\riant2019\small.png
C:\install\smallchoice.png
%WINDIR%\syswow64\msres\skin\riant2019\smallchoice.png
C:\install\snapshot.png
%WINDIR%\syswow64\msres\skin\riant2019\snapshot.png
C:\install\snapshot1.png
%WINDIR%\syswow64\msres\skin\riant2019\snapshot1.png
C:\install\Г®ВґГ±ВЎГ¶Г°1.png
%WINDIR%\syswow64\msres\skin\riant2019\Г®ВґГ±ВЎГ¶Г°1.png
C:\install\ВІГ©Г±ВЇ.png
%WINDIR%\syswow64\msres\skin\riant2019\ВІГ©Г±ВЇ.png
C:\install\Г±ВЎГ¶Г°1.png
%WINDIR%\syswow64\msres\skin\riant2019\Г±ВЎГ¶Г°1.png
%WINDIR%\syswow64\msres\skin.ini
C:\install\smss.exe
%WINDIR%\syswow64\msres\smss.exe
C:\install\special.ini
%WINDIR%\syswow64\msres\special.ini
C:\install\sqlite3.dll
%WINDIR%\syswow64\msres\sqlite3.dll
C:\install\sqlite64.dll
%WINDIR%\syswow64\msres\sqlite64.dll
C:\install\ssleay32.dll
%WINDIR%\syswow64\msres\ssleay32.dll
C:\install\stoplog.bat
%WINDIR%\syswow64\msres\stoplog.bat
C:\install\svccom.exe
%WINDIR%\syswow64\msres\svccom.exe
C:\install\svcdsk.exe
%WINDIR%\syswow64\msres\svcdsk.exe
C:\install\svchost.exe
%WINDIR%\syswow64\msres\svchost.exe
C:\install\svcnet.exe
%WINDIR%\syswow64\msres\svcnet.exe
C:\install\svcvpd.exe
%WINDIR%\syswow64\msres\svcvpd.exe
C:\install\svcwtr.exe
%WINDIR%\syswow64\msres\svcwtr.exe
C:\install\swresample-2.dll
%WINDIR%\syswow64\msres\swresample-2.dll
C:\install\swscale-4.dll
%WINDIR%\syswow64\msres\swscale-4.dll
C:\install\sysaid.exe
%WINDIR%\syswow64\msres\sysaid.exe
C:\install\windowspatch.db
%WINDIR%\syswow64\msres\sysinfo\windowspatch.db
C:\install\systeminfo.dll
%WINDIR%\syswow64\msres\systeminfo.dll
C:\install\taskkeyhook.dll
%WINDIR%\syswow64\msres\taskkeyhook.dll
C:\install\tasksend.dll
%WINDIR%\syswow64\msres\tasksend.dll
C:\install\trayicon.exe
%WINDIR%\syswow64\msres\trayicon.exe
C:\install\turbodll.dll
%WINDIR%\syswow64\msres\turbodll.dll
C:\install\ucommon.exe
%WINDIR%\syswow64\msres\ucommon.exe
C:\install\ufsd32.dll
%WINDIR%\syswow64\msres\ufsd32.dll
C:\install\ufsd64.dll
%WINDIR%\syswow64\msres\ufsd64.dll
C:\install\ufsdcrypto32.dll
%WINDIR%\syswow64\msres\ufsdcrypto32.dll
C:\install\ufsdcrypto64.dll
%WINDIR%\syswow64\msres\ufsdcrypto64.dll
C:\install\ufsdicon32.dll
%WINDIR%\syswow64\msres\ufsdicon32.dll
C:\install\ufsdicon64.dll
%WINDIR%\syswow64\msres\ufsdicon64.dll
C:\install\unicodedll.dll
%WINDIR%\syswow64\msres\unicodedll.dll
C:\install\unpack.exe
%WINDIR%\syswow64\msres\unpack.exe
C:\install\usbmanage.dll
%WINDIR%\syswow64\msres\usbmanage.dll
C:\install\userctrl32.dll
%WINDIR%\syswow64\msres\userctrl32.dll
C:\install\userctrl64.dll
%WINDIR%\syswow64\msres\userctrl64.dll
C:\install\verctrl.dll
%WINDIR%\syswow64\msres\verctrl.dll
C:\install\vfsd_fre_win10_amd64.sys
%WINDIR%\syswow64\msres\vfsd_fre_win10_amd64.sys
C:\install\vfsd_fre_win10_x86.sys
%WINDIR%\syswow64\msres\vfsd_fre_win10_x86.sys
C:\install\vfsd_fre_win7_amd64-replace.sys
%WINDIR%\syswow64\msres\vfsd_fre_win7_amd64-replace.sys
C:\install\vfsd_fre_win7_amd64.sys
%WINDIR%\syswow64\msres\vfsd_fre_win7_amd64.sys
C:\install\vfsd_fre_win7_x86.sys
%WINDIR%\syswow64\msres\vfsd_fre_win7_x86.sys
C:\install\vfsd_fre_wlh_amd64.sys
%WINDIR%\syswow64\msres\vfsd_fre_wlh_amd64.sys
C:\install\vfsd_fre_wlh_x86.sys
%WINDIR%\syswow64\msres\vfsd_fre_wlh_x86.sys
C:\install\vfsd_fre_wnet_amd64.sys
%WINDIR%\syswow64\msres\vfsd_fre_wnet_amd64.sys
C:\install\vfsd_fre_wnet_x86.sys
%WINDIR%\syswow64\msres\vfsd_fre_wnet_x86.sys
C:\install\vfsd_fre_wxp_x86.sys
%WINDIR%\syswow64\msres\vfsd_fre_wxp_x86.sys
C:\install\vgwdrv.dll
%WINDIR%\syswow64\msres\vgwdrv.dll
C:\install\vgwdrv.inf
%WINDIR%\syswow64\msres\vgwdrv.inf
C:\install\vgwdrv.sys
%WINDIR%\syswow64\msres\vgwdrv.sys
C:\install\viewc.dll
%WINDIR%\syswow64\msres\viewc.dll
C:\install\viewrecording.dll
%WINDIR%\syswow64\msres\viewrecording.dll
C:\install\viewrect.dll
%WINDIR%\syswow64\msres\viewrect.dll
C:\install\viewrect64.dll
%WINDIR%\syswow64\msres\viewrect64.dll
C:\install\vscomlib.dll
%WINDIR%\syswow64\msres\vscomlib.dll
C:\install\vsetup.exe
%WINDIR%\syswow64\msres\vsetup.exe
C:\install\wifipolicydll.dll
%WINDIR%\syswow64\msres\wifipolicydll.dll
C:\install\wni.ytf
%WINDIR%\syswow64\msres\wni.ytf
C:\install\dismapi.dll
%WINDIR%\syswow64\msres\x64drivers\dismapi.dll
C:\install\minifs.cab
%WINDIR%\syswow64\msres\x64drivers\microsoft sign\minifs\disk1\minifs.cab
C:\install\minifs.inf
%WINDIR%\syswow64\msres\x64drivers\microsoft sign\minifs\minifs.inf
C:\install\minifs.sys
%WINDIR%\syswow64\msres\x64drivers\microsoft sign\minifs\minifs.sys
C:\install\test.ddf
%WINDIR%\syswow64\msres\x64drivers\microsoft sign\minifs\test.ddf
%WINDIR%\syswow64\msres\x64drivers\microsoft sign\vgwdrv\test.ddf
%WINDIR%\syswow64\msres\x64drivers\microsoft sign\vgwdrv\vgwdrv.dll
%WINDIR%\syswow64\msres\x64drivers\microsoft sign\vgwdrv\vgwdrv.inf
C:\install\netft64.sys
%WINDIR%\syswow64\msres\x64drivers\netft64.sys
C:\install\netftxp64.sys
%WINDIR%\syswow64\msres\x64drivers\netftxp64.sys
C:\install\procmon64.sys
%WINDIR%\syswow64\msres\x64drivers\procmon64.sys
C:\install\sgfp64.sys
%WINDIR%\syswow64\msres\x64drivers\sgfp64.sys
C:\install\sgfp64_win10.sys
%WINDIR%\syswow64\msres\x64drivers\sgfp64_win10.sys
%WINDIR%\syswow64\msres\x64drivers\test.ddf
%WINDIR%\syswow64\msres\x64drivers\vgwdrv.dll
%WINDIR%\syswow64\msres\x64drivers\vgwdrv.inf
%WINDIR%\syswow64\msres\x64drivers\vgwdrv.sys
C:\install\vgwdrv64-win10.dll
%WINDIR%\syswow64\msres\x64drivers\vgwdrv64-win10.dll
C:\install\vgwdrv64-win7.dll
%WINDIR%\syswow64\msres\x64drivers\vgwdrv64-win7.dll
C:\install\vgwdrv64.dll
%WINDIR%\syswow64\msres\x64drivers\vgwdrv64.dll
C:\install\vgwdrv64.inf
%WINDIR%\syswow64\msres\x64drivers\vgwdrv64.inf
C:\install\vgwdrv64.sys
%WINDIR%\syswow64\msres\x64drivers\vgwdrv64.sys
C:\install\vgwdrvx64.cat
%WINDIR%\syswow64\msres\x64drivers\vgwdrvx64.cat
C:\install\vsetup64.exe
%WINDIR%\syswow64\msres\x64drivers\vsetup64.exe
C:\install\ytdisk64.sys
%WINDIR%\syswow64\msres\x64drivers\ytdisk64.sys
C:\install\ytminifilter.inf
%WINDIR%\syswow64\msres\x64drivers\ytminifilter.inf
C:\install\ytminifilter.sys
%WINDIR%\syswow64\msres\x64drivers\ytminifilter.sys
C:\install\ytminifilterdrvx64.cat
%WINDIR%\syswow64\msres\x64drivers\ytminifilterdrvx64.cat
C:\install\xfmainth.dll
%WINDIR%\syswow64\msres\xfmainth.dll
C:\install\ytdisk.sys
%WINDIR%\syswow64\msres\ytdisk.sys
C:\install\ytdisk2_32.sys
%WINDIR%\syswow64\msres\ytdisk2_32.sys
C:\install\ytdisk2_64.sys
%WINDIR%\syswow64\msres\ytdisk2_64.sys
C:\install\ytfundll32.dll
%WINDIR%\syswow64\msres\ytfundll32.dll
C:\install\ytfundll64.dll
%WINDIR%\syswow64\msres\ytfundll64.dll
%WINDIR%\syswow64\msres\ytminifilter.inf
%WINDIR%\syswow64\msres\ytminifilter.sys
C:\install\ytminifilter64.sys
%WINDIR%\syswow64\msres\ytminifilter64.sys
C:\install\ytshellext32.dll
%WINDIR%\syswow64\msres\ytshellext32.dll
C:\install\ytshellext64.dll
%WINDIR%\syswow64\msres\ytshellext64.dll
C:\install\ytuiafun.dll
%WINDIR%\syswow64\msres\ytuiafun.dll
C:\install\curl.exe
%WINDIR%\syswow64\msres\yundisk\curl.exe
%WINDIR%\syswow64\msres\yundisk\lanmap.dll
%WINDIR%\syswow64\msres\yundisk\libeay32.dll
%WINDIR%\syswow64\msres\yundisk\local.ini
C:\install\36.png
%WINDIR%\syswow64\msres\yundisk\skin\36.png
C:\install\approval1.png
%WINDIR%\syswow64\msres\yundisk\skin\approval1.png
C:\install\approval2.png
%WINDIR%\syswow64\msres\yundisk\skin\approval2.png
C:\install\approval3.png
%WINDIR%\syswow64\msres\yundisk\skin\approval3.png
C:\install\btnclose1.png
%WINDIR%\syswow64\msres\yundisk\skin\btnclose1.png
C:\install\btnclose2.png
%WINDIR%\syswow64\msres\yundisk\skin\btnclose2.png
C:\install\btndel1.png
%WINDIR%\syswow64\msres\yundisk\skin\btndel1.png
C:\install\btndel2.png
%WINDIR%\syswow64\msres\yundisk\skin\btndel2.png
C:\install\btndownload1.png
%WINDIR%\syswow64\msres\yundisk\skin\btndownload1.png
C:\install\btndownload2.png
%WINDIR%\syswow64\msres\yundisk\skin\btndownload2.png
C:\install\btnjump1.png
%WINDIR%\syswow64\msres\yundisk\skin\btnjump1.png
C:\install\btnjump2.png
%WINDIR%\syswow64\msres\yundisk\skin\btnjump2.png
C:\install\btnjump3.png
%WINDIR%\syswow64\msres\yundisk\skin\btnjump3.png
C:\install\btnlast1.png
%WINDIR%\syswow64\msres\yundisk\skin\btnlast1.png
C:\install\btnlast2.png
%WINDIR%\syswow64\msres\yundisk\skin\btnlast2.png
C:\install\btnlast3.png
%WINDIR%\syswow64\msres\yundisk\skin\btnlast3.png
C:\install\btnnew1.png
%WINDIR%\syswow64\msres\yundisk\skin\btnnew1.png
C:\install\btnnew2.png
%WINDIR%\syswow64\msres\yundisk\skin\btnnew2.png
C:\install\btnnext1.png
%WINDIR%\syswow64\msres\yundisk\skin\btnnext1.png
C:\install\btnnext2.png
%WINDIR%\syswow64\msres\yundisk\skin\btnnext2.png
C:\install\btnnext3.png
%WINDIR%\syswow64\msres\yundisk\skin\btnnext3.png
C:\install\btnrecovery1.png
%WINDIR%\syswow64\msres\yundisk\skin\btnrecovery1.png
C:\install\btnrecovery2.png
%WINDIR%\syswow64\msres\yundisk\skin\btnrecovery2.png
C:\install\btnsearch1.png
%WINDIR%\syswow64\msres\yundisk\skin\btnsearch1.png
C:\install\btnsearch2.png
%WINDIR%\syswow64\msres\yundisk\skin\btnsearch2.png
C:\install\btnupload1.png
%WINDIR%\syswow64\msres\yundisk\skin\btnupload1.png
C:\install\btnupload2.png
%WINDIR%\syswow64\msres\yundisk\skin\btnupload2.png
C:\install\collect1.png
%WINDIR%\syswow64\msres\yundisk\skin\collect1.png
C:\install\collect2.png
%WINDIR%\syswow64\msres\yundisk\skin\collect2.png
C:\install\collect3.png
%WINDIR%\syswow64\msres\yundisk\skin\collect3.png
C:\install\fanhui.png
%WINDIR%\syswow64\msres\yundisk\skin\fanhui.png
C:\install\documenttype1.png
%WINDIR%\syswow64\msres\yundisk\skin\icon\documenttype1.png
C:\install\documenttype15.png
%WINDIR%\syswow64\msres\yundisk\skin\icon\documenttype15.png
C:\install\documenttype17.png
%WINDIR%\syswow64\msres\yundisk\skin\icon\documenttype17.png
C:\install\documenttype20.png
%WINDIR%\syswow64\msres\yundisk\skin\icon\documenttype20.png
C:\install\documenttype20_1.png
%WINDIR%\syswow64\msres\yundisk\skin\icon\documenttype20_1.png
C:\install\documenttype3.png
%WINDIR%\syswow64\msres\yundisk\skin\icon\documenttype3.png
C:\install\documenttype36.png
%WINDIR%\syswow64\msres\yundisk\skin\icon\documenttype36.png
C:\install\documenttype43.png
%WINDIR%\syswow64\msres\yundisk\skin\icon\documenttype43.png
C:\install\icon-excel.png
%WINDIR%\syswow64\msres\yundisk\skin\icon\icon-excel.png
C:\install\icon-folder.png
%WINDIR%\syswow64\msres\yundisk\skin\icon\icon-folder.png
C:\install\icon-pdf.png
%WINDIR%\syswow64\msres\yundisk\skin\icon\icon-pdf.png
C:\install\icon-ppt.png
%WINDIR%\syswow64\msres\yundisk\skin\icon\icon-ppt.png
C:\install\icon-word.png
%WINDIR%\syswow64\msres\yundisk\skin\icon\icon-word.png
C:\install\accbkg2.png
%WINDIR%\syswow64\msres\yundisk\skin\images\accbkg2.png
C:\install\accicon.png
%WINDIR%\syswow64\msres\yundisk\skin\images\accicon.png
C:\install\account.png
%WINDIR%\syswow64\msres\yundisk\skin\images\account.png
C:\install\btn-19.png
%WINDIR%\syswow64\msres\yundisk\skin\images\btn-19.png
C:\install\btn-24.png
%WINDIR%\syswow64\msres\yundisk\skin\images\btn-24.png
C:\install\btn.png
%WINDIR%\syswow64\msres\yundisk\skin\images\btn.png
C:\install\c1-06.png
%WINDIR%\syswow64\msres\yundisk\skin\images\c1-06.png
C:\install\c1-09.png
%WINDIR%\syswow64\msres\yundisk\skin\images\c1-09.png
C:\install\c1.png
%WINDIR%\syswow64\msres\yundisk\skin\images\c1.png
C:\install\c2-05.png
%WINDIR%\syswow64\msres\yundisk\skin\images\c2-05.png
C:\install\c2-08.png
%WINDIR%\syswow64\msres\yundisk\skin\images\c2-08.png
C:\install\c2.png
%WINDIR%\syswow64\msres\yundisk\skin\images\c2.png
C:\install\c3-04.png
%WINDIR%\syswow64\msres\yundisk\skin\images\c3-04.png
C:\install\c3-07.png
%WINDIR%\syswow64\msres\yundisk\skin\images\c3-07.png
C:\install\c3.png
%WINDIR%\syswow64\msres\yundisk\skin\images\c3.png
C:\install\efs-icon_53.png
%WINDIR%\syswow64\msres\yundisk\skin\images\efs-icon_53.png
C:\install\efs-icon_58.png
%WINDIR%\syswow64\msres\yundisk\skin\images\efs-icon_58.png
C:\install\efs-menu_11-02.png
%WINDIR%\syswow64\msres\yundisk\skin\images\efs-menu_11-02.png
C:\install\efs-menu_11.png
%WINDIR%\syswow64\msres\yundisk\skin\images\efs-menu_11.png
C:\install\logout.png
%WINDIR%\syswow64\msres\yundisk\skin\images\logout.png
C:\install\mainback.png
%WINDIR%\syswow64\msres\yundisk\skin\images\mainback.png
C:\install\modpwd.png
%WINDIR%\syswow64\msres\yundisk\skin\images\modpwd.png
C:\install\yh1.png
%WINDIR%\syswow64\msres\yundisk\skin\images\yh1.png
C:\install\yh2.png
%WINDIR%\syswow64\msres\yundisk\skin\images\yh2.png
C:\install\logo.png
%WINDIR%\syswow64\msres\yundisk\skin\logo.png
C:\install\myreceive1.png
%WINDIR%\syswow64\msres\yundisk\skin\myreceive1.png
C:\install\myreceive2.png
%WINDIR%\syswow64\msres\yundisk\skin\myreceive2.png
C:\install\myreceive3.png
%WINDIR%\syswow64\msres\yundisk\skin\myreceive3.png
C:\install\myspace1.png
%WINDIR%\syswow64\msres\yundisk\skin\myspace1.png
C:\install\myspace2.png
%WINDIR%\syswow64\msres\yundisk\skin\myspace2.png
C:\install\myspace3.png
%WINDIR%\syswow64\msres\yundisk\skin\myspace3.png
C:\install\ourspace1.png
%WINDIR%\syswow64\msres\yundisk\skin\ourspace1.png
C:\install\ourspace2.png
%WINDIR%\syswow64\msres\yundisk\skin\ourspace2.png
C:\install\ourspace3.png
%WINDIR%\syswow64\msres\yundisk\skin\ourspace3.png
C:\install\recycle1.png
%WINDIR%\syswow64\msres\yundisk\skin\recycle1.png
C:\install\recycle2.png
%WINDIR%\syswow64\msres\yundisk\skin\recycle2.png
C:\install\recycle3.png
%WINDIR%\syswow64\msres\yundisk\skin\recycle3.png
C:\install\thumbs.db
%WINDIR%\syswow64\msres\yundisk\skin\thumbs.db
C:\install\svcyun.exe
%WINDIR%\syswow64\msres\yundisk\svcyun.exe
%WINDIR%\syswow64\msres\yundisk\turbodll.dll
C:\install\vscommon.dll
%WINDIR%\syswow64\msres\yundisk\vscommon.dll
C:\install\yunoper.dll
%WINDIR%\syswow64\msres\yunoper.dll
C:\install\zip.dll
%WINDIR%\syswow64\msres\zip.dll
C:\log\setup.log

Deletes following files that it created itself

C:\install\000dffbd
C:\install\setuptool.exe
C:\install\32.bat
C:\install\64.bat
C:\install\7z.dll
C:\install\7z.exe
C:\install\7zsd.sfx
C:\install\8021xclient.dll
C:\install\adobase.dll
C:\install\ansidll.dll
C:\install\assistantthc.dll
C:\install\auditorviewwaitlist.exe
C:\install\avcodec-57.dll
C:\install\avdevice-57.dll
C:\install\avfilter-6.dll
C:\install\avformat-57.dll
C:\install\avutil-55.dll
C:\install\beginlog.bat
C:\install\change.dll
C:\install\chi_sim.traineddata
C:\install\cj60lib.dll
C:\install\cleanpermissions.bat
C:\install\clienttool.exe
C:\install\comfun.dll
C:\install\chatrecord.db
C:\install\riben.ytf
C:\install\scanauditdb.db
C:\install\scanfulldb.db
C:\install\desktopduplication.dll
C:\install\devicemanage.dll
C:\install\encryptgui.exe
C:\install\excelfundll.dll
C:\install\exit.bat
C:\install\fileencrypt.dll
C:\install\filetransport.dll
C:\install\fsconfig.ytf
C:\install\fshost32.exe
C:\install\fshost64.exe
C:\install\genewm.exe
C:\install\gfunlib32.dll
C:\install\gfunlib64.dll
C:\install\globaluserctrl32.dll
C:\install\globaluserctrl64.dll
C:\install\gui.dll
C:\install\help.bat
C:\install\helpformat.bat
C:\install\hkforbit.dll
C:\install\hksock32.dll
C:\install\hksock64.dll
C:\install\icontray.ico
C:\install\ijl15.dll
C:\install\imagelib.dll
C:\install\imageocr.dll
C:\install\injectdll32.exe
C:\install\installex.exe
C:\install\itp.ytf
C:\install\english.ytf
C:\install\lanmap.dll
C:\install\libeay32.dll
C:\install\libsedisk.dll
C:\install\local.ini
C:\install\manc.exe
C:\install\mfc140u.dll
C:\install\mframe.dll
C:\install\msch.dll
C:\install\msch64.dll
C:\install\msgtrack.dll
C:\install\mspm32.dll
C:\install\mspm64.dll
C:\install\msproc.dll
C:\install\netbase.dll
C:\install\netclass.dll
C:\install\netconfig.ytf
C:\install\netft.sys
C:\install\netftxp.sys
C:\install\netjmfile32.dll
C:\install\netjmfile64.dll
C:\install\nettran.dll
C:\install\netw.ytf
C:\install\newicon.ico
C:\install\newlockdesk.dll
C:\install\newuishortcut.exe
C:\install\nfapi.dll
C:\install\packetupdate.dll
C:\install\paraset.ytf
C:\install\postproc-54.dll
C:\install\procmon.sys
C:\install\procw.ytf
C:\install\detection.dll
C:\install\detection.ini
C:\install\fadisk.sys
C:\install\fadisk_x64.sys
C:\install\fastmnt.dll
C:\install\fastmnt.sys
C:\install\fastmnt_x64.sys
C:\install\frsdk.dll
C:\install\frsdk.ini
C:\install\frsdktest-2020.10.14 bak.exe
C:\install\frsdktest.exe
C:\install\license.txt
C:\install\readme.txt
C:\install\restore.dll
C:\install\rstdata.bin
C:\install\stdmbr.bin
C:\install\protocolfilters.dll
C:\install\rar.exe
C:\install\rdf.ytf
C:\install\rdt.ytf
C:\install\restorekrl.dll
C:\install\safeport.ytf
C:\install\scanofficedll.dll
C:\install\screenlock.bmp
C:\install\screenlock.exe
C:\install\scw32.dll
C:\install\scw64.dll
C:\install\scwnew.dll
C:\install\sedisk.sys
C:\install\sedisk64.sys
C:\install\setpermissions.bat
C:\install\setup.exe
C:\install\sgfp.sys
C:\install\bk.png
C:\install\cancel.png
C:\install\cancel1.png
C:\install\cancel2.png
C:\install\cwts_03.bmp
C:\install\depsel.png
C:\install\depsel1.png
C:\install\dh2_01.png
C:\install\dh_01.png
C:\install\doc.png
C:\install\down.png
C:\install\fswj_01.png
C:\install\fswj_02.png
C:\install\fswj_03.png
C:\install\gwxz.png
C:\install\gxz.png
C:\install\jpg.png
C:\install\more.png
C:\install\pdf.png
C:\install\ppt.png
C:\install\qdan_01.png
C:\install\qdan_02.png
C:\install\qdan_03.png
C:\install\qxan2_09.png
C:\install\qxan3_09.png
C:\install\sc.png
C:\install\scyp_01.png
C:\install\scyp_02.png
C:\install\scyp_03.png
C:\install\ss.png
C:\install\sx_01.png
C:\install\wjj.png
C:\install\wj_01.png
C:\install\wp.png
C:\install\xk_01.png
C:\install\xk_02.png
C:\install\xk_03.png
C:\install\xx.bmp
C:\install\xx.png
C:\install\xz.png
C:\install\yp.png
C:\install\zip.png
C:\install\pack_bg.bmp
C:\install\pack_head1.bmp
C:\install\pack_head2.bmp
C:\install\seachnone.bmp
C:\install\search.bmp
C:\install\upload.png
C:\install\userchange_bk.bmp
C:\install\userreg.png
C:\install\userreg001.png
C:\install\userreg002.png
C:\install\userreg2.png
C:\install\userreg3.png
C:\install\bk123.jpg
C:\install\bk_assist.png
C:\install\mapbg.png
C:\install\patch_repairall_bk.png
C:\install\patch_repairall_bk_clicked.png
C:\install\topbg.jpg
C:\install\btnclose.bmp
C:\install\btnclose1.bmp
C:\install\btnclose2.bmp
C:\install\btnclose3.bmp
C:\install\btnmin.bmp
C:\install\btnmin1.bmp
C:\install\btnmin2.bmp
C:\install\btnmin3.bmp
C:\install\btnuser.bmp
C:\install\circul1.bmp
C:\install\circul2.bmp
C:\install\clientlogo.png
C:\install\close1.bmp
C:\install\close2.bmp
C:\install\close_03.png
C:\install\close_05.png
C:\install\close_1.bmp
C:\install\close_user.png
C:\install\close_user1.png
C:\install\commit0.png
C:\install\dengji.png
C:\install\down.bmp
C:\install\down1.bmp
C:\install\down2.bmp
C:\install\gb_01.png
C:\install\gb_02.png
C:\install\gb_03.png
C:\install\gx_01.bmp
C:\install\gx_02.bmp
C:\install\head_03.jpg
C:\install\min.bmp
C:\install\myfix.bmp
C:\install\myfix_2.bmp
C:\install\ok.png
C:\install\open_03_01.png
C:\install\open_03_02.png
C:\install\open_03_03.png
C:\install\patch-win-icon.png
C:\install\patchbuttoncancel.png
C:\install\patchbuttoncancel2.png
C:\install\patchinfo.png
C:\install\patchquery.png
C:\install\patchquery2.png
C:\install\patch_cancel1.png
C:\install\patch_cancel2.png
C:\install\patch_icon_first.png
C:\install\patch_icon_left.png
C:\install\patch_icon_left2.png
C:\install\preview1.bmp
C:\install\preview2.bmp
C:\install\qhdl_01.bmp
C:\install\qhdl_02.bmp
C:\install\qhdl_03.bmp
C:\install\qhdl_04.bmp
C:\install\refreshbt_1.bmp
C:\install\repair.bmp
C:\install\repair2.bmp
C:\install\repairall.png
C:\install\repairall2.png
C:\install\select_all.bmp
C:\install\select_all2.bmp
C:\install\select_fan.bmp
C:\install\select_fan2.bmp
C:\install\sendbt_1.bmp
C:\install\sendbt_2.bmp
C:\install\sendbt_3.bmp
C:\install\sx_02.png
C:\install\sx_03.png
C:\install\sz_01.png
C:\install\sz_02.png
C:\install\sz_03.png
C:\install\up.bmp
C:\install\uploadbt_1.bmp
C:\install\uploadbt_2.bmp
C:\install\uploadbt_3.bmp
C:\install\userchange_01.bmp
C:\install\userchange_02.bmp
C:\install\userchange_03.bmp
C:\install\userregclose.png
C:\install\xuan0.png
C:\install\xx_01.bmp
C:\install\xx_02.bmp
C:\install\xx_03.bmp
C:\install\yj_01.bmp
C:\install\yj_02.bmp
C:\install\zhuce.png
C:\install\box_1.bmp
C:\install\box_2.bmp
C:\install\box_3.bmp
C:\install\dir.bmp
C:\install\dir_bk.bmp
C:\install\dir_splite.bmp
C:\install\doc.bmp
C:\install\jpg.bmp
C:\install\pdf.bmp
C:\install\ppt.bmp
C:\install\safedisk.bmp
C:\install\wjj.bmp
C:\install\yundisk.bmp
C:\install\chat.png
C:\install\chat_1.png
C:\install\gx01.png
C:\install\ico1.png
C:\install\ico2.png
C:\install\ico3.png
C:\install\ico4.png
C:\install\ico5.png
C:\install\ico6.png
C:\install\ico7.png
C:\install\ico_force.png
C:\install\ico_ture.png
C:\install\jzai.gif
C:\install\p0.png
C:\install\p0_1.png
C:\install\p1.png
C:\install\p1_1.png
C:\install\p2.png
C:\install\p2_1.png
C:\install\p3.png
C:\install\p3_1.png
C:\install\p4.png
C:\install\p4_1.png
C:\install\p5.png
C:\install\p5_1.png
C:\install\p6.png
C:\install\p6_1.png
C:\install\p7.png
C:\install\p7_1.png
C:\install\pnetdisk.png
C:\install\pnetdisk_1.png
C:\install\soft1.png
C:\install\up.png
C:\install\usmall.png
C:\install\wifi-no.png
C:\install\wifi.png
C:\install\activecaption.bmp
C:\install\dialogbk.bmp
C:\install\exit_down.bmp
C:\install\exit_foc.bmp
C:\install\exit_nor.bmp
C:\install\formviewbk.bmp
C:\install\frameborder.bmp
C:\install\frametopborder.bmp
C:\install\headerctrlnormal.bmp
C:\install\horizontalthumb.bmp
C:\install\inactivecaption.bmp
C:\install\leftarrow.bmp
C:\install\max_down.bmp
C:\install\max_focu.bmp
C:\install\max_norm.bmp
C:\install\menudown.bmp
C:\install\menufocus.bmp
C:\install\menuitemdown.bmp
C:\install\min_down.bmp
C:\install\min_focu.bmp
C:\install\min_norm.bmp
C:\install\new-barexpand.bmp
C:\install\new-btnleft.bmp
C:\install\new-btnmid.bmp
C:\install\new-btnright.bmp
C:\install\new-cancelbk.bmp
C:\install\new-exit_nor.bmp
C:\install\new-loginbodybk.bmp
C:\install\new-logintitlebk.bmp
C:\install\new-menubt.bmp
C:\install\new-menuitemback.bmp
C:\install\new-min_norm.bmp
C:\install\new-okbk.bmp
C:\install\new-res_down.bmp
C:\install\new-tabheadbk.bmp
C:\install\new-tabheadbtn.bmp
C:\install\res_down.bmp
C:\install\res_focu.bmp
C:\install\res_norm.bmp
C:\install\rightarrow.bmp
C:\install\scrollbarbk.bmp
C:\install\skin.ini
C:\install\tableft.bmp
C:\install\tableftsel.bmp
C:\install\tabmid.bmp
C:\install\tabmidsel.bmp
C:\install\tabright.bmp
C:\install\tabrightsel.bmp
C:\install\toolbarback.bmp
C:\install\toolbarfocus.bmp
C:\install\viewbk.bmp
C:\install\chatbtn.png
C:\install\chatbtnhold.png
C:\install\close.png
C:\install\closechoice.png
C:\install\depbtn.png
C:\install\depbtnhold.png
C:\install\sendfile.png
C:\install\sendfile1.png
C:\install\sendmsg.png
C:\install\sendmsg1.png
C:\install\small.png
C:\install\smallchoice.png
C:\install\snapshot.png
C:\install\snapshot1.png
C:\install\Г®ВґГ±ВЎГ¶Г°1.png
C:\install\ВІГ©Г±ВЇ.png
C:\install\Г±ВЎГ¶Г°1.png
C:\install\smss.exe
C:\install\special.ini
C:\install\sqlite3.dll
C:\install\sqlite64.dll
C:\install\ssleay32.dll
C:\install\stoplog.bat
C:\install\svccom.exe
C:\install\svcdsk.exe
C:\install\svchost.exe
C:\install\svcnet.exe
C:\install\svcvpd.exe
C:\install\svcwtr.exe
C:\install\swresample-2.dll
C:\install\swscale-4.dll
C:\install\sysaid.exe
C:\install\windowspatch.db
C:\install\systeminfo.dll
C:\install\taskkeyhook.dll
C:\install\tasksend.dll
C:\install\trayicon.exe
C:\install\turbodll.dll
C:\install\ucommon.exe
C:\install\ufsd32.dll
C:\install\ufsd64.dll
C:\install\ufsdcrypto32.dll
C:\install\ufsdcrypto64.dll
C:\install\ufsdicon32.dll
C:\install\ufsdicon64.dll
C:\install\unicodedll.dll
C:\install\unpack.exe
C:\install\usbmanage.dll
C:\install\userctrl32.dll
C:\install\userctrl64.dll
C:\install\verctrl.dll
C:\install\vfsd_fre_win10_amd64.sys
C:\install\vfsd_fre_win10_x86.sys
C:\install\vfsd_fre_win7_amd64-replace.sys
C:\install\vfsd_fre_win7_amd64.sys
C:\install\vfsd_fre_win7_x86.sys
C:\install\vfsd_fre_wlh_amd64.sys
C:\install\vfsd_fre_wlh_x86.sys
C:\install\vfsd_fre_wnet_amd64.sys
C:\install\vfsd_fre_wnet_x86.sys
C:\install\vfsd_fre_wxp_x86.sys
C:\install\vgwdrv.dll
C:\install\vgwdrv.inf
C:\install\vgwdrv.sys
C:\install\viewc.dll
C:\install\viewrecording.dll
C:\install\viewrect.dll
C:\install\viewrect64.dll
C:\install\vscomlib.dll
C:\install\vsetup.exe
C:\install\wifipolicydll.dll
C:\install\wni.ytf
C:\install\dismapi.dll
C:\install\minifs.cab
C:\install\minifs.inf
C:\install\minifs.sys
C:\install\test.ddf
C:\install\netft64.sys
C:\install\netftxp64.sys
C:\install\procmon64.sys
C:\install\sgfp64.sys
C:\install\sgfp64_win10.sys
C:\install\vgwdrv64-win10.dll
C:\install\vgwdrv64-win7.dll
C:\install\vgwdrv64.dll
C:\install\vgwdrv64.inf
C:\install\vgwdrv64.sys
C:\install\vgwdrvx64.cat
C:\install\vsetup64.exe
C:\install\ytdisk64.sys
C:\install\ytminifilter.inf
C:\install\ytminifilter.sys
C:\install\ytminifilterdrvx64.cat
C:\install\xfmainth.dll
C:\install\ytdisk.sys
C:\install\ytdisk2_32.sys
C:\install\ytdisk2_64.sys
C:\install\ytfundll32.dll
C:\install\ytfundll64.dll
C:\install\ytminifilter64.sys
C:\install\ytshellext32.dll
C:\install\ytshellext64.dll
C:\install\ytuiafun.dll
C:\install\curl.exe
C:\install\36.png
C:\install\approval1.png
C:\install\approval2.png
C:\install\approval3.png
C:\install\btnclose1.png
C:\install\btnclose2.png
C:\install\btndel1.png
C:\install\btndel2.png
C:\install\btndownload1.png
C:\install\btndownload2.png
C:\install\btnjump1.png
C:\install\btnjump2.png
C:\install\btnjump3.png
C:\install\btnlast1.png
C:\install\btnlast2.png
C:\install\btnlast3.png
C:\install\btnnew1.png
C:\install\btnnew2.png
C:\install\btnnext1.png
C:\install\btnnext2.png
C:\install\btnnext3.png
C:\install\btnrecovery1.png
C:\install\btnrecovery2.png
C:\install\btnsearch1.png
C:\install\btnsearch2.png
C:\install\btnupload1.png
C:\install\btnupload2.png
C:\install\collect1.png
C:\install\collect2.png
C:\install\collect3.png
C:\install\fanhui.png
C:\install\documenttype1.png
C:\install\documenttype15.png
C:\install\documenttype17.png
C:\install\documenttype20.png
C:\install\documenttype20_1.png
C:\install\documenttype3.png
C:\install\documenttype36.png
C:\install\documenttype43.png
C:\install\icon-excel.png
C:\install\icon-folder.png
C:\install\icon-pdf.png
C:\install\icon-ppt.png
C:\install\icon-word.png
C:\install\accbkg2.png
C:\install\accicon.png
C:\install\account.png
C:\install\btn-19.png
C:\install\btn-24.png
C:\install\btn.png
C:\install\c1-06.png
C:\install\c1-09.png
C:\install\c1.png
C:\install\c2-05.png
C:\install\c2-08.png
C:\install\c2.png
C:\install\c3-04.png
C:\install\c3-07.png
C:\install\c3.png
C:\install\efs-icon_53.png
C:\install\efs-icon_58.png
C:\install\efs-menu_11-02.png
C:\install\efs-menu_11.png
C:\install\logout.png
C:\install\mainback.png
C:\install\modpwd.png
C:\install\yh1.png
C:\install\yh2.png
C:\install\logo.png
C:\install\myreceive1.png
C:\install\myreceive2.png
C:\install\myreceive3.png
C:\install\myspace1.png
C:\install\myspace2.png
C:\install\myspace3.png
C:\install\ourspace1.png
C:\install\ourspace2.png
C:\install\ourspace3.png
C:\install\recycle1.png
C:\install\recycle2.png
C:\install\recycle3.png
C:\install\thumbs.db
C:\install\svcyun.exe
C:\install\vscommon.dll
C:\install\yunoper.dll
C:\install\zip.dll
C:\install\0004c8d9

Substitutes the following files

C:\install\sx_01.png
C:\install\down.bmp
C:\install\search.bmp
C:\install\qdan_01.png
C:\install\qdan_02.png
C:\install\qdan_03.png
C:\install\skin.ini
C:\install\setuptool.exe
C:\install\test.ddf
C:\install\vgwdrv.dll
C:\install\vgwdrv.inf
C:\install\vgwdrv.sys
C:\install\ytminifilter.inf
C:\install\ytminifilter.sys
C:\install\lanmap.dll
C:\install\libeay32.dll
C:\install\local.ini
C:\install\turbodll.dll

Network activity

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ea##############

UDP

DNS ASK pi#######.tos-cn-beijing.volces.com

Miscellaneous

Creates and executes the following

'%TEMP%\47.85.99.19clientsetup.exe'
'%WINDIR%\syswow64\msres\setup.exe' /Serv
'%WINDIR%\syswow64\msres\setup.exe' /InstallC
'%WINDIR%\syswow64\msres\vsetup.exe' /VideoSetup
'%WINDIR%\syswow64\msres\setup.exe' /Commit
'%WINDIR%\syswow64\manc.exe'
'%WINDIR%\syswow64\msres\sysaid.exe' /QuickStart
'%WINDIR%\syswow64\msres\svchost.exe'
'%WINDIR%\syswow64\msres\setup.exe' /CopyeVersionFile
'%WINDIR%\syswow64\msres\smss.exe'

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""<SYSTEM32>\msres\64.bat" "
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo y"
'%WINDIR%\syswow64\cacls.exe' %WINDIR%\syswow64\msres\log /G system:f everyone:f
'%WINDIR%\syswow64\cacls.exe' %WINDIR%\syswow64\msres\log\OutFile /G system:f everyone:f
'%WINDIR%\syswow64\cacls.exe' %WINDIR%\syswow64\msres\log\OutFile\File /G system:f everyone:f
'%WINDIR%\syswow64\cacls.exe' %CommonProgramFiles%\ytcommon /G system:f everyone:f
'%WINDIR%\syswow64\cacls.exe' %WINDIR%\syswow64\msres /G system:f everyone:f
'%WINDIR%\syswow64\cmd.exe' /c ""<SYSTEM32>\msres\64.bat" "' (with hidden window)
'%WINDIR%\syswow64\msres\sysaid.exe' /QuickStart' (with hidden window)
'%WINDIR%\syswow64\msres\setup.exe' /CopyeVersionFile' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial