Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '{BE8521F8-C937-D688-D688-D3D9BA55CEB4}' = '%APPDATA%\guide.exe'
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\alert.html
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %APPDATA%\guide.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\how to recover encrypted files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\how to recover encrypted files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\how to recover encrypted files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\how to recover encrypted files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\how to recover encrypted files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\how to recover encrypted files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\how to recover encrypted files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\how to recover encrypted files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\enu\how to recover encrypted files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\how to recover encrypted files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\how to recover encrypted files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\how to recover encrypted files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\how to recover encrypted files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\how to recover encrypted files.txt
- C:\far2\plugins\ftp\how to recover encrypted files.txt
- C:\far2\encyclopedia\tap\how to recover encrypted files.txt
- C:\far2\documentation\rus\how to recover encrypted files.txt
- C:\far2\documentation\eng\how to recover encrypted files.txt
- C:\far2\addons\how to recover encrypted files.txt
- %HOMEPATH%\desktop\how to recover encrypted files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\how to recover encrypted files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\how to recover encrypted files.txt
Deletes the following files
- %APPDATA%\guide.exe
Moves the following files
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\3w000000000uc+idrmtu3rz9izlxgciu.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons_hicontrast_bow.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\8g000000001wgo0mbjmbt+gwfr+b7p725z1kjold3txjcghlzcwrp4yyzdsa7x8k-ehbyfz3zgs.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highcontrast_wob.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\d0000000003aykzyc6afqjp3vnhtegyrumrkcotirs5ekdgsik1lzkkm3b8cvibfdrfxsfigkhc6nx+uuy...
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highcontrast_bow.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\d0000000002xygk+xp5hz25hh9ngubklzdo2tnr1be2yz9gdg9f6gpqjbpefdwqsvaniuy1paj6-1xtpjn...
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\aic_file_icons_highcontrast.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\8m0000000015bh13vyls883akantxv8+hlsz6b22vlgr4+usto+laoj2dznr+ccahhfpeisp-ks.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\aic_file_icons_hicontrast_wob.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\9g0000000009amsgrihb+wz8sxbzarbkjnipa3fkrqavuxqxbzni2hgdb7gkmdludvqetqd6rtk.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\aic_file_icons_hicontrast_bow.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\9g000000003bbtt8nooym7azymhytrf4snx611jvhc2tnaufm-5oiti4a-bq+skbvkghn9zi-e8.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\cloud_icon.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\4w000000000n082wpxcqvxrc0etj49ey3e6hakif8kknm6ci1f9ucw.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\aic_file_icons_retina_thumb.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\8m000000002up7chmgo41tlz05lb63lhkjp6azc7dnoabuvfvshwyzdamc5n8v5v8fy-ijaegiq.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\aic_file_icons_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\6g0000000020loldlhny0von8evmyupfrj9cfhvlk9ykoh7juerb9m.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\aic_file_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\5w000000000kawpgqmrjvhds8jqx99d91zs9mlnddxu3kecdusgi4g.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\selection-actions2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\6m000000001fkxu+p82de9-ahxto28kxgeiqzmctoin2mvxqci6uh0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\selection-actions.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\6g000000002+mszu4cxbjsxtv7s6st+8iymynmxuwbuhk1-a+wo8cg.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\rhp_icons_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\50000000001ovlp5jsdq-4epjx88z6ajbupsszc1ivbz4fyy3tg2m0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\rhp_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\4g000000002gev+iqfcbfn8udqry1hj-oibvpf9ob7izoeommwwlug.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\progress_spinner_dark.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\7g000000000oi5jx9osbqhnp6hlet8ybipvfkuqqwr0nqszasfzwkm.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons_highcontrast.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\7m000000003ijl4rzij9rzp7byqxxitmuceuw1zdlwlsgrfywb9vim.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\progress_spinner2x.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\6w000000003sfzabonefmfrxxbgf4lkxa22pu52+onaovxwjrxeymm.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\progress_spinner.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\60000000003aiu3vyxdzl0hmf9+0vjrjmgijuqxwwdg9hdcztabuhm.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\progress-indeterminate.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\7w000000001lwch0a8mr4thbjhtni8c9uudmsgrgimgxgms7pm8wr0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\logo_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\4m000000003ovmkjgurp3crbg6215anns4g9a14u2dimrpc8uq5n+0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\large_trefoil_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\60000000000slby2qog2uvwisfywfq1koptqrr5dlvucevl6o31mtg.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\large_trefoil.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\5g000000002qvsvalsqoo2cvrqc0mighztnoaozowjrlumbk-q798g.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\japanese_over.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\5g000000003q9iopzn9f36vf6-c8dxfx1dqkprlxxddtjomaw9upw0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\ind_prog.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\40000000000acubl0wv5y6g3sx+tq5pf.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\illustrations_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\70000000001xmhygcbvuus8ptbrdptwwbhd7f8d8jhbks99gng-isw.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\illustrations.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\5g000000000rzu-76wtk21jcjn9k8pe4oi6keaivhbd9hoyqt7ifn0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\dd_arrow_small.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\5w0000000020400blqwnrw9wwhb5fm8iqafsvc5prezlf7qggxmmkm.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\core_icons_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\6g000000001iu5iih1kye3cfoedc-d0mzlig-hccrtih5hpgyulzzw.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\core_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\4w000000002la0zvzs8atnq-tzrfrvegswntpnqcombymdzygj6jgw.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\progress_spinner_dark2x.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\7m000000003u1xannvbs92c8ehxki9xsbrdpavzj1lmvsdsvechzv0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnoffnotificationinacrobat.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\90000000003nvfjipvhlwuil4oqb4yykohpwhvi31sd6jxcawh828a3sk4pzeem-yh4vzipqlns.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\9w000000002uez1wmcjlgfuna-yfyit-s7wnurgciwpjctdsow664ftdw0tczvno022c1f2jc+w.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\warning_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\4w000000002q5w0plmqwecgr-7djrmehglvzp4s7blx9+a3fwn1jyw.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\warning.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\3m0000000013-5yveokv2s5zs2q9rrsv.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\rhp_world_icon_hover_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\7m000000001dzdbo354qgbhsb9ghzw48rhudn8dhkeetsepulkplaw.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\rhp_world_icon_hover.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\700000000020lqxy2r+lsq4jdj3k2n+u3gclpl-bl4xlxfipx0ngj0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\rhp_world_icon_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\6g000000000sfpll5ibt4agit0ppmlkuagd6pfk6hz+z7xdfrtru-0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\rhp_world_icon.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\5w000000000kufxn1gxmvylevnkjg8badbw65q87fhcvel7cwwatl0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\new_icons_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\60000000003c7b9docpg1uboxlhk7adlumqys0cjkhtcg7nkjpazm0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\new_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\4g000000002nswurbllgb52x2vg2of4y-utnvx8dccrrr73vr812ag.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\illustrations_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\70000000003kbsjbdtmmvahcavtc4y9il+qsmygrshmcqcssw9i+3m.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\illustrations.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\5g000000002datlgscbi57x4wkn0wbkpyjljh1lt8vmhf0qgrokwnw.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\icons_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\50000000001s8w+xptk+bgynxsv4tvdtb7-fsyfyf6ypke+hg-prww.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\icons_ie8.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\4g0000000007kd+czyfkt4nv0u71jcugfeg9x5wp54usk2fwccydjm.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\3g000000002dcphnbmbqr7gmanqhfbsq.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\bg_pattern_rhp.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\5w000000000ziizpl4-o+wq66e3rrl4eb0g3daj3wcody4yomixtlg.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\close_x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\3m0000000001rnacsbxe0+d5nb9menn1.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons_hicontrast_wob.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\8g000000001u5h-qafadgjjtgnbknzmtehgoef+2mojqewopy8qpyl6r+m+pt-otmzzfaosxmbc.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-up-pressed.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\60000000000mg-mrsb0buhropwsy7hvmdta1dqdhc1dtf-wlipqhom.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-right.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\4m0000000019ghqknlqs+uwygem+gxzjzsb-3e6bhzc3q3kyile52g.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-right-pressed.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\6m0000000036curj7nt0xxyj2cqydhk8g3nzkbvpfkvln-qjn97yn0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-left.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\4w000000000pf1lp2ln8aspi1yt3udpqkkce9wbzgakr0fxgsz9rog.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-left-pressed.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\6w000000002caaht4o8orwagqgjg3ueteprklmd0jvknuwtjuxkuh0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-down.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\4w000000003rdr22xalhit6rzbib2k0uqpbqat2fjsekaxynqsnnig.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-down-pressed.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\6w000000002hmorv-eddtslso8gir2xdac3vyrvdw7bpb+2ruwcjag.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\vscroll-thumb.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\5g000000001bjyqqsopwrz7loeepznvtzgq0g5cwl1u7c7mxwkg1qg.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\hscroll-thumb.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\5g000000003fpp7-wqmx7el2vzlkphfxsowx0ferjolsononhfo0dg.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\arrow-up.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\40000000001eccnfhlo0xypbbkeansxa.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\arrow-right.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\4m000000001wmut4ntsv6jlekssesl5v6foclkrdreuyaoioonpe8w.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\arrow-left.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\4w000000002tqhbxeirstfrrpjrk7quhhb23of7uavc6gmul5soggw.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\arrow-down.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\4w000000002nhmmjs4ycm8vubdcnbucv2fbheioed129dkjvbsm7yg.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons__retina_hicontrast_wob.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\ag0000000003pjjdkv5ngvvdcfuhgotvemka4f9h0k5fqmherh6ymvgvnlqm6uvfkajgfoxgutg.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-up.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\40000000003mp-1nx9saigo4ig3vec7w.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons__retina_hicontrast_bow.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\ag0000000011gtwjlpkwdpqksnffy4nrm2-euanlj2sfb3dl4ys3m3mb82o0ouxyj-gxbkjlyco.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\ccloud_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\5g000000003bwcxtbgxhyxo-5ypelp3c9jpeukdy8ejhfqnymmaqum.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\ccloud.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\3w000000003pn5mbfcg1vxqkb9e1c9me.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\apple-touch-icon-72x72-precomposed.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\aw000000000f62fdozmw3ugxndi-ush1akkuknw12vvrlksi31ro+qsqbkywkiz5dxwji04l4pi.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\standardbusiness.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\60000000003ti7bf4chgrp+gmldwpguzqgmhwxqdjjahexitrqwfpm.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\info.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\30000000003o2uj4m2xn-s+kfjdn41cw.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\form_responses.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\5w000000000ekyl61uaa82dlkptzh3dy-5bppkwu6algycpqcyao40.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_super.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\4m000000000e2kc2c4i-m2xcl+dvknyul+bm2qtwbulatxurezbddm.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_received.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\5w000000001qyzzd3jcgskudvrzetgnlxc5ii4cvqjtkswnazfrgcm.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_distributed.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\6g0000000022xkb7zhj3xjpyhicuvbkv6izx6yelt9vhupg3bbpzkm.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\end_review.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\4w000000002b3ljw2fq50k4n-jnljcq+ok4bpxwwxicl5ohjnldhqm.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\ended_review_or_form.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\70000000000mhghlgda2vnx3iopl703kz7nzzjeymbsxjk9qhzzbog.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\email_initiator.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\5m000000002grwwmqislwnplokc3qniwwar2nk0ukdoy3t4rvitiug.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\email_all.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\4g000000000yi06095y+6fkdgywzzq+uzlpaulqspgtot6s-7tiz8w.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\distribute_form.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\5m000000003tjifzufuv0hilyziqt5uu6hz-qgmo0c2gfbomncmurg.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\create_form.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\4m000000003vcvcugcxvhajl845kchodwup32cdq6q7heyf1bizrpm.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\br.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\2w000000002bopz0qobhlhrhhsq7+llb.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\bl.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\2w000000000jd9rscf0gmwmr3xcva7+t.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\example_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\5g000000000axlyv-1nw91h4bn00gofweqnf7uwpqmgec-gtyeswbg.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\pdf.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\2m000000000itovchgn-fehziq+p5ldx.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\signhere.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\40000000001je5nqibafc7nlxfqmhtaz.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\dynamic.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\3m000000001vp54s65gjvcsn+cmwmqsw.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\words.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\3g000000001efrbkdfq60jft9y5s67md.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\enu\license.html to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\enu\40000000002n1sfv4wpvi+v8+4mt3yvx.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\5g000000000nldy+jd6q5mm+uzstn3k5hikw1znx-nhcet4oz7ghvw.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\defaultid.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\4g000000001pq5j+krphkseq4l2jkwf8q3hopwnuzphl6vg5ve7prm.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\adobeid.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\3m000000000ypg42rmd6okfq2hzc857v.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\snapshot_blob.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\5g000000003k5p+2wsl4ic7lzeq0aamqh1hlgyag6murddgzpzwc60.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\natives_blob.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\50000000001ifkfv5ixatmqog2nrfumq7ucqp4ktkn4qioiqibml5g.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\3w0000000024ke-lnliarpyjnqqp2ph8.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\2m000000001ba+qpqu5nonp758pse26z.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pmd.cer to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\2m000000000+n6jvf8ci+y-v5qsl-g8f.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfsigqformalrep.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\60000000002pue3ttanl1vf8-kru47jwu2ad21zal5wnmu1iukm-vw.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cg000000002t+mlv-0xpaapldjtzqeokyciqcmflrzfabu7g4zp5baznx8pmezm4amei-ntgmxqfmn1ggcnyq+isz7vl7whh.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\add_reviewer.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\50000000002+djee4xdrzgbahptqgy0ugpnrsxyrappwta-hl9o1vm.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\bg_patterns_header.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\6w000000002ptlm1u1f2hblyywddnoafwhxklwd3ui5i+rsyw12rb0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviewers.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\4g000000002zkgjii1g7prpmnuildui20seif6gvuhtfytqwzcx6-m.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviews_super.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\5g000000000bwezejjjowqlin9f98sw2qpu4iqyotb77fq7fezxvt0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviews_joined.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\5w000000003pgdka0lshh4reeu9ljhplkt3eyoqyejo7tyoxypo2+w.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\apple-touch-icon-57x57-precomposed.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\aw000000003wyptdlwg7a-inhztjz3fnrhdpw3bg3dxn5atj-s8ltbfuo-gcqawcgsg+ta2w1v0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\apple-touch-icon-144x144-precomposed.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\b0000000003kh21bdipq3feyovzrpoa3tcqt0h-22z9demcjderfkvhutijaen0-3tpzxwv7ais.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\apple-touch-icon-114x114-precomposed.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\b0000000003nhqch1rpc5two5ovkc1over4dvfo2quhs3n99op0v7dgbc59v43fhiyabiwwhyli.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\adobe_spinner_mini.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\6w000000003gpxuavaq71ssip-tqpmkinhpnqfrbjtbdddnmiynp5m.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\adobe_spinner.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\5g000000003dnjlebhos74+u4tmyeqbfropihgppevhv4smumetcam.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\adc_logo.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\40000000000wlzsqtelbjzyvqybazinx.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\a12_spinner_int_2x.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\6w000000001ab8olveow7rcirg3oiv-qrcncn5-2ihk6g8bqfqdxum.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\a12_spinner_int.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\5m000000001suhoei49misuuqcmxe1yxdqw9vkne26ttokposn2hc0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\a12_spinner_2x.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\5w000000003nj9x5rkyk3ztu1skvonvks1nfpkpgs24xe5babcwlyw.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\a12_spinner.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\4m000000000hwgox057rwhsdmdt6jmjj5hkd-kpmd-lyhnco3pl2tm.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\index.html to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\3w000000000ssshdcr7+omsmnzrou85x.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\warning.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\3m000000001rkduvtprvwgubkuhqdxml.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnonnotificationintray.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\80000000000mtd2-kd3xpgmbggfayxb2qze9k11amabgrfufimhj0g.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviews_sent.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\50000000003ejqlou+vom8-z5tcr4feibf7pfmy2bu0rg9uxg9a1fg.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnonnotificationinacrobat.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\8m000000000v75rygy4akxlcrwdihm0olxq196mj88dlwojwnfmk0joyegrrz0utnbhc+d0v5w8.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\open_original_form.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\6w000000003kjwcfze8we7tkioywuzuftgob9fmbokmuhb2bh5trkw.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\trash.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\3g000000003wqguuz63gvkqvnvsjdzcx.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\tr.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\2w000000001yazeukidxjizbwhxply5c.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\tl.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\2w0000000013u15igkp9qjiofvbieh+l.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\submission_history.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\6w000000000hhsvr68eolbvpqsfau9puth-z+ggs4z8u8yv0pvcne0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\stop_collection_data.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\70000000000qukjfjjht-a0b7+q6yilhrbuyycgxshibgqks-72c2g.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_ok.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\4g000000002a5x+zdlh+buljew+lo89c4byx8vnks1xotuzjjoec50.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_lg.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\4g000000002k9lfwg3xchp9tx0za-qrud5x8jp827axrjpiuqhj6+m.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_issue.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\50000000003ecnql7kswm43jnvqkjb192gjcdoacdsdz8wyqfpuzow.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\rss.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\2m000000002jt+yx7lzncciiz2wovwgg.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\review_shared.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\5g000000001azrhfqnd4bfs2acifkupswwvdcxmxleqbitt6nrvdkg.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\review_same_reviewers.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\7g000000003r9s0v6zdw12scaiqigsr5vp3ddyfi62iaktrkebc8qm.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\review_email.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\50000000000sv4drokpb0x6avslmsi0iy5-rozl3cb5osjfy25sr9m.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\review_browser.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\5w000000003m49qhjwr6+gucgmthsdbtjzajcht+dxkiruw6q-e+nw.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnoffnotificationintray.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\8g000000001rurku7wikgjavpcqygpjvrfl1eufjxbwiezkqjdj-urwndbicppircqpvtabn1x0.frogo
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\example_icons2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\5m000000000rvo9v6uh0d+xxav5uz8ggdcs5snmg5569r-t7sjcto0.frogo
Substitutes the following files
- %APPDATA%\guide.exe
Modifies user data files (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin Delete Shadows /for=C: /All' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin Delete Shadows /for=D: /All' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin Delete Shadows /for=E: /All' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin Delete Shadows /for=F: /All' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c wmic SHADOWCOPY DELETE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin Delete Shadows /All /Quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} recoveryenabled No' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin Delete Shadows /for=C: /All
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin Delete Shadows /for=D: /All
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin Delete Shadows /for=E: /All
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin Delete Shadows /for=F: /All
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0
- '%WINDIR%\syswow64\cmd.exe' /c wmic SHADOWCOPY DELETE
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin Delete Shadows /All /Quiet
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} recoveryenabled No
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\vssvc.exe'
