Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\168.jpeg
- <Drive name for removable media>:\parnas_01.jpeg
- <Drive name for removable media>:\3.jpg
- <Drive name for removable media>:\4f0bf7ff71f28.jpg
- <Drive name for removable media>:\parnas_01.jpg
- <Drive name for removable media>:\168.jpg
- <Drive name for removable media>:\2.jpg
- <Drive name for removable media>:\dag2_panel1_320_ref.mov
- <Drive name for removable media>:\scan.mov
- <Drive name for removable media>:\video.mp4
- <Drive name for removable media>:\51.mp4
- <Drive name for removable media>:\d0068197bb5a41fea16a220c45390606.mp4
- <Drive name for removable media>:\7790_preview.pdf
- <Drive name for removable media>:\bc01.pdf
- <Drive name for removable media>:\sacs_presentation_sacs_qep_improving_rt_education_final.ppt
- <Drive name for removable media>:\dualectls.pdf
- <Drive name for removable media>:\2015-02-patients-topic-work-related-asthma-jobs.pdf
- <Drive name for removable media>:\10thingscondoms.pdf
- <Drive name for removable media>:\irgeek.pem
- <Drive name for removable media>:\systisoft.pem
- <Drive name for removable media>:\cert.pem
- <Drive name for removable media>:\investmentbankca_ca8.pem
- <Drive name for removable media>:\asm.png
- <Drive name for removable media>:\arrow-down.png
- <Drive name for removable media>:\bg_search_box.png
- <Drive name for removable media>:\cbz.png
- <Drive name for removable media>:\breakpoint.png
- <Drive name for removable media>:\sim_gametheory_to_finance.ppt
- <Drive name for removable media>:\3.jpeg
- <Drive name for removable media>:\2015-02-worms-nanoparticle-toxicity.pdf
- <Drive name for removable media>:\pushkin.jpeg
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\hanni_umami_chapter.doc
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\howto-index.html
- <Drive name for removable media>:\issi2013_template_for_posters.docx
- <Drive name for removable media>:\holycrosschurchinstructions.docx
- <Drive name for removable media>:\nwfieldnotes1966.docx
- <Drive name for removable media>:\sdszfo.docx
- <Drive name for removable media>:\file_p_00000000_1371597592.docx
- <Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
- <Drive name for removable media>:\winmine.exe
- <Drive name for removable media>:\calc.exe
- <Drive name for removable media>:\skypesetup.exe
- <Drive name for removable media>:\browse.htm
- <Drive name for removable media>:\about.htm
- <Drive name for removable media>:\iisstart.html
- <Drive name for removable media>:\adadsi.html
- <Drive name for removable media>:\ituneshelpunavailable.html
- <Drive name for removable media>:\mappingconcepthubberlin.ppt
Modifies file system
Creates the following files
- C:\#readthis.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\locale\#readthis.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\locale\#readthis.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\#readthis.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\#readthis.hta
- C:\far2\#readthis.txt
- C:\far2\#readthis.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\#readthis.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\#readthis.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\#readthis.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\#readthis.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\#readthis.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\#readthis.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\#readthis.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\#readthis.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\#readthis.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\#readthis.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\#readthis.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\#readthis.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\#readthis.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\#readthis.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\#readthis.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\#readthis.hta
- C:\$recycle.bin\#readthis.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\#readthis.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\#readthis.txt
- C:\users\#readthis.hta
- %ProgramFiles(x86)%\#readthis.txt
- %ProgramFiles(x86)%\#readthis.hta
- %ProgramFiles(x86)%\adobe\#readthis.txt
- %ProgramFiles(x86)%\adobe\#readthis.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\#readthis.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\#readthis.hta
- %ProgramFiles%\#readthis.txt
- %ProgramFiles%\#readthis.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\#readthis.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\#readthis.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\#readthis.txt
- D:\#readthis.txt
- D:\#readthis.hta
- C:\$recycle.bin\#readthis.txt
- D:\$recycle.bin\#readthis.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\#readthis.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\#readthis.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\#readthis.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\#readthis.hta
- D:\$recycle.bin\#readthis.hta
- C:\users\#readthis.txt
- C:\#readthis.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\#readthis.hta
Moves the following files
- from %ProgramFiles(x86)%\desktop.ini to %ProgramFiles(x86)%\[deathspicy@yandex.ru][id=dfbaf005]desktop.ini.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\mpp\quicktime.mpp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\mpp\[deathspicy@yandex.ru][id=dfbaf005]quicktime.mpp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\mpp\windowsmedia.mpp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\mpp\[deathspicy@yandex.ru][id=dfbaf005]windowsmedia.mpp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\64bitmapibroker.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\[deathspicy@yandex.ru][id=dfbaf005]64bitmapibroker.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\2d.x3d to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\[deathspicy@yandex.ru][id=dfbaf005]2d.x3d.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\3difr.x3d to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\[deathspicy@yandex.ru][id=dfbaf005]3difr.x3d.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\drvdx9.x3d to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\[deathspicy@yandex.ru][id=dfbaf005]drvdx9.x3d.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\drvsoft.x3d to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\[deathspicy@yandex.ru][id=dfbaf005]drvsoft.x3d.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\prcr.x3d to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\[deathspicy@yandex.ru][id=dfbaf005]prcr.x3d.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\tesselate.x3d to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\[deathspicy@yandex.ru][id=dfbaf005]tesselate.x3d.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\prc\myriadcad.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\prc\[deathspicy@yandex.ru][id=dfbaf005]myriadcad.otf.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\add_reviewer.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]add_reviewer.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\bl.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]bl.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\br.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]br.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\create_form.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]create_form.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\distribute_form.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]distribute_form.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\email_all.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]email_all.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\email_initiator.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]email_initiator.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\ended_review_or_form.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]ended_review_or_form.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\end_review.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]end_review.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_distributed.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]forms_distributed.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_received.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]forms_received.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\mpp\mcimpp.mpp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\mpp\[deathspicy@yandex.ru][id=dfbaf005]mcimpp.mpp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ebook.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]ebook.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\mpp\flash.mpp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\mpp\[deathspicy@yandex.ru][id=dfbaf005]flash.mpp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\standardbusiness.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\[deathspicy@yandex.ru][id=dfbaf005]standardbusiness.pdf.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ia32.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]ia32.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\makeaccessible.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]makeaccessible.api.lizard
- from %ProgramFiles%\a2hijackfree\a2hijackfree.exe to %ProgramFiles%\a2hijackfree\[deathspicy@yandex.ru][id=dfbaf005]a2hijackfree.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]multimedia.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pddom.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]pddom.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ppklite.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]ppklite.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\readoutloud.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]readoutloud.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\reflow.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]reflow.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\saveasrtf.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]saveasrtf.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\search.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]search.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\sendmail.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]sendmail.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\spelling.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]spelling.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\updater.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]updater.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\weblink.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]weblink.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\adobepdf.xdc to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\[deathspicy@yandex.ru][id=dfbaf005]adobepdf.xdc.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\pmp\adobepdf417.pmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\pmp\[deathspicy@yandex.ru][id=dfbaf005]adobepdf417.pmp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\pmp\datamatrix.pmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\pmp\[deathspicy@yandex.ru][id=dfbaf005]datamatrix.pmp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\pmp\qrcode.pmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\pmp\[deathspicy@yandex.ru][id=dfbaf005]qrcode.pmp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\words.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\[deathspicy@yandex.ru][id=dfbaf005]words.pdf.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\dynamic.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\[deathspicy@yandex.ru][id=dfbaf005]dynamic.pdf.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\signhere.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\[deathspicy@yandex.ru][id=dfbaf005]signhere.pdf.lizard
- from %ProgramFiles%\a2scan\a2scan.exe to %ProgramFiles%\a2scan\[deathspicy@yandex.ru][id=dfbaf005]a2scan.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\escript.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]escript.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_super.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]forms_super.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\open_original_form.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]open_original_form.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\base_uris.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\[deathspicy@yandex.ru][id=dfbaf005]base_uris.js.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\index.html to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\[deathspicy@yandex.ru][id=dfbaf005]index.html.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\init.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\[deathspicy@yandex.ru][id=dfbaf005]init.js.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\plugins.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\[deathspicy@yandex.ru][id=dfbaf005]plugins.js.lizard
- from %ProgramFiles%\a2start\a2start.exe to %ProgramFiles%\a2start\[deathspicy@yandex.ru][id=dfbaf005]a2start.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\variant.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\[deathspicy@yandex.ru][id=dfbaf005]variant.js.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\version.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\[deathspicy@yandex.ru][id=dfbaf005]version.js.lizard
- from %ProgramFiles%\a2upd\a2upd.exe to %ProgramFiles%\a2upd\[deathspicy@yandex.ru][id=dfbaf005]a2upd.exe.lizard
- from %ProgramFiles%\a2wizard\a2wizard.exe to %ProgramFiles%\a2wizard\[deathspicy@yandex.ru][id=dfbaf005]a2wizard.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\cpdf_full.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[deathspicy@yandex.ru][id=dfbaf005]cpdf_full.aapp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\css\main-cef-high-contrast.css to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\css\[deathspicy@yandex.ru][id=dfbaf005]main-cef-high-contrast.css.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\css\main-cef-mac.css to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\css\[deathspicy@yandex.ru][id=dfbaf005]main-cef-mac.css.lizard
- from %ProgramFiles%\about\about.exe to %ProgramFiles%\about\[deathspicy@yandex.ru][id=dfbaf005]about.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\css\main-cef-win.css to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\css\[deathspicy@yandex.ru][id=dfbaf005]main-cef-win.css.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\css\main-cef-win8.css to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\css\[deathspicy@yandex.ru][id=dfbaf005]main-cef-win8.css.lizard
- from %ProgramFiles%\ackwin32\ackwin32.exe to %ProgramFiles%\ackwin32\[deathspicy@yandex.ru][id=dfbaf005]ackwin32.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\css\main-cef.css to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\css\[deathspicy@yandex.ru][id=dfbaf005]main-cef.css.lizard
- from %ProgramFiles%\admunch\admunch.exe to %ProgramFiles%\admunch\[deathspicy@yandex.ru][id=dfbaf005]admunch.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\css\main-high-contrast.css to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\css\[deathspicy@yandex.ru][id=dfbaf005]main-high-contrast.css.lizard
- from %ProgramFiles%\agb5\agb5.exe to %ProgramFiles%\agb5\[deathspicy@yandex.ru][id=dfbaf005]agb5.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnonnotificationintray.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]turnonnotificationintray.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\warning.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]warning.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\info.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]info.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\form_responses.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]form_responses.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnoffnotificationinacrobat.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]turnoffnotificationinacrobat.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\pdf.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]pdf.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviewers.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]reviewers.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviews_joined.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]reviews_joined.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviews_sent.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]reviews_sent.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviews_super.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]reviews_super.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\review_browser.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]review_browser.gif.lizard
- from %ProgramFiles%\a2service\a2service.exe to %ProgramFiles%\a2service\[deathspicy@yandex.ru][id=dfbaf005]a2service.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\review_email.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]review_email.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\review_same_reviewers.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]review_same_reviewers.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\review_shared.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]review_shared.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\rss.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]rss.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_issue.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]server_issue.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_lg.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]server_lg.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_ok.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]server_ok.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\stop_collection_data.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]stop_collection_data.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\submission_history.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]submission_history.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\tl.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]tl.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\tr.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]tr.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\trash.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]trash.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnoffnotificationintray.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]turnoffnotificationintray.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\main.css to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]main.css.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnonnotificationinacrobat.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\[deathspicy@yandex.ru][id=dfbaf005]turnonnotificationinacrobat.gif.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\dva.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]dva.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\dropboxstorage.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]dropboxstorage.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\digsig.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]digsig.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\bib.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]bib.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\bibutils.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]bibutils.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ccme_asym.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]ccme_asym.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ccme_base.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]ccme_base.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ccme_base_non_fips.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]ccme_base_non_fips.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ccme_ecc.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]ccme_ecc.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ccme_ecdrbg.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]ccme_ecdrbg.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cooltype.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]cooltype.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]cryptocme.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]cryptocme.sig.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\eula.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]eula.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\extendscript.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]extendscript.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\icucnv40.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]icucnv40.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\icudt40.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]icudt40.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\jp2klib.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]jp2klib.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\logsession.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]logsession.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\logtransport2.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]logtransport2.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\onix32.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]onix32.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfprevhndlr.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]pdfprevhndlr.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfsigqformalrep.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]pdfsigqformalrep.pdf.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\axe8sharedexpat.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]axe8sharedexpat.dll.lizard
- from %ProgramFiles%\360tray\360tray.exe to %ProgramFiles%\360tray\[deathspicy@yandex.ru][id=dfbaf005]360tray.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\arh.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]arh.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]agmgpuoptin.ini.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\[deathspicy@yandex.ru][id=dfbaf005]readme.htm.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\[deathspicy@yandex.ru][id=dfbaf005]aiodlite.dll.lizard
- from %ProgramFiles%\desktop.ini to %ProgramFiles%\[deathspicy@yandex.ru][id=dfbaf005]desktop.ini.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]a3dutils.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ace.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]ace.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrobroker.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]acrobroker.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrofx32.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]acrofx32.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]acrord32.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]acrord32.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32info.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]acrord32info.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32res.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]acrord32res.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrosup64.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]acrosup64.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrotextextractor.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]acrotextextractor.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adelrcp.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]adelrcp.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]adobe.reader.dependencies.manifest.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobecollabsync.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]adobecollabsync.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobelinguistic.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]adobelinguistic.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adoberfp.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]adoberfp.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobexmp.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]adobexmp.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agm.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]agm.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ahclient.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]ahclient.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pe.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]pe.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\axsle.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]axsle.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pmd.cer to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]pmd.cer.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_200_percent.pak to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[deathspicy@yandex.ru][id=dfbaf005]cef_200_percent.pak.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\libcef.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[deathspicy@yandex.ru][id=dfbaf005]libcef.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\natives_blob.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[deathspicy@yandex.ru][id=dfbaf005]natives_blob.bin.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[deathspicy@yandex.ru][id=dfbaf005]rdrcef.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rdrservicesupdater.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[deathspicy@yandex.ru][id=dfbaf005]rdrservicesupdater.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\snapshot_blob.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[deathspicy@yandex.ru][id=dfbaf005]snapshot_blob.bin.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\locales\en-us.pak to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\locales\[deathspicy@yandex.ru][id=dfbaf005]en-us.pak.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\air\nppdf32.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\air\[deathspicy@yandex.ru][id=dfbaf005]nppdf32.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\browser\nppdf32.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\browser\[deathspicy@yandex.ru][id=dfbaf005]nppdf32.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\adobeid.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\[deathspicy@yandex.ru][id=dfbaf005]adobeid.pdf.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\defaultid.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\[deathspicy@yandex.ru][id=dfbaf005]defaultid.pdf.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\[deathspicy@yandex.ru][id=dfbaf005]jsbytecodewin.bin.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\enu\eula.ini to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\enu\[deathspicy@yandex.ru][id=dfbaf005]eula.ini.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\enu\license.html to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\enu\[deathspicy@yandex.ru][id=dfbaf005]license.html.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\locale\en_us\stopwords.enu to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\locale\en_us\[deathspicy@yandex.ru][id=dfbaf005]stopwords.enu.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\accessibility.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]accessibility.api.lizard
- from %ProgramFiles%\a2guard\a2guard.exe to %ProgramFiles%\a2guard\[deathspicy@yandex.ru][id=dfbaf005]a2guard.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]acroform.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annots.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]annots.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\checkers.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\[deathspicy@yandex.ru][id=dfbaf005]checkers.api.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_100_percent.pak to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[deathspicy@yandex.ru][id=dfbaf005]cef_100_percent.pak.lizard
- from %ProgramFiles%\a2cmd\a2cmd.exe to %ProgramFiles%\a2cmd\[deathspicy@yandex.ru][id=dfbaf005]a2cmd.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[deathspicy@yandex.ru][id=dfbaf005]icudtl.dat.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[deathspicy@yandex.ru][id=dfbaf005]cef.pak.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\viewer.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[deathspicy@yandex.ru][id=dfbaf005]viewer.aapp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\reader_sl.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]reader_sl.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]rtc.der.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\sccore.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]sccore.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\sqlite.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]sqlite.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\viewerps.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]viewerps.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\wow_helper.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]wow_helper.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\appcenter_r.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[deathspicy@yandex.ru][id=dfbaf005]appcenter_r.aapp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\certificates_r.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[deathspicy@yandex.ru][id=dfbaf005]certificates_r.aapp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\collectsignatures.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[deathspicy@yandex.ru][id=dfbaf005]collectsignatures.aapp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\combine_r_rhp.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[deathspicy@yandex.ru][id=dfbaf005]combine_r_rhp.aapp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\css\main.css to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\css\[deathspicy@yandex.ru][id=dfbaf005]main.css.lizard
- from %ProgramFiles%\aavshield\aavshield.exe to %ProgramFiles%\aavshield\[deathspicy@yandex.ru][id=dfbaf005]aavshield.exe.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\comments.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[deathspicy@yandex.ru][id=dfbaf005]comments.aapp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\edit_r_full.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[deathspicy@yandex.ru][id=dfbaf005]edit_r_full.aapp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\edit_r_rhp.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[deathspicy@yandex.ru][id=dfbaf005]edit_r_rhp.aapp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\epdf_full.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[deathspicy@yandex.ru][id=dfbaf005]epdf_full.aapp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\epdf_rhp.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[deathspicy@yandex.ru][id=dfbaf005]epdf_rhp.aapp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\fillsign.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[deathspicy@yandex.ru][id=dfbaf005]fillsign.aapp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\home.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[deathspicy@yandex.ru][id=dfbaf005]home.aapp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\measure.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[deathspicy@yandex.ru][id=dfbaf005]measure.aapp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\stamp.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[deathspicy@yandex.ru][id=dfbaf005]stamp.aapp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\trackedsend.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[deathspicy@yandex.ru][id=dfbaf005]trackedsend.aapp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rt3d.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[deathspicy@yandex.ru][id=dfbaf005]rt3d.dll.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\cpdf_rhp.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[deathspicy@yandex.ru][id=dfbaf005]cpdf_rhp.aapp.lizard
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\a12_spinner.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\[deathspicy@yandex.ru][id=dfbaf005]a12_spinner.gif.lizard
Moves itself
- from <Full path to file> to <Current directory>\[deathspicy@yandex.ru][id=dfbaf005]<File name>.exe.lizard
Modifies user data files (Trojan.Encoder).
Network activity
TCP
- 'localhost':49173
- 'localhost':49195
- 'localhost':49193
- 'pa####rdwolf.com':443
- 'localhost':49191
- 'localhost':49190
- 'localhost':49188
- 'cs##g.net':443
- 'localhost':49186
- 'localhost':49185
- 'localhost':49183
- 'ra##om.org':443
- 'localhost':49181
- 'localhost':49180
- 'localhost':49178
- 'pa####rdrandom.com':443
- 'localhost':49176
- 'localhost':49175
- 'localhost':49196
- 'ap#.##legram.org':443
UDP
- DNS ASK pa####rdrandom.com
- DNS ASK ra##om.org
- DNS ASK cs##g.net
- DNS ASK pa####rdwolf.com
- DNS ASK ap#.##legram.org
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c vol C
