Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.Encoder.32799

Added to the Dr.Web virus database: 2020-10-11

Virus description added:

Technical Information

To ensure autorun and distribution
Creates the following files on removable media
  • <Drive name for removable media>:\correct.avi
  • <Drive name for removable media>:\hypothyroidism_slides.pptx
  • <Drive name for removable media>:\middaugh_keynote.pptx
  • <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
  • <Drive name for removable media>:\asaprojectcompetition.pptx
  • <Drive name for removable media>:\february_catalogue__2015.doc
  • <Drive name for removable media>:\fi51.doc
  • <Drive name for removable media>:\ovp25012015.doc
  • <Drive name for removable media>:\applicantform_en.doc
  • <Drive name for removable media>:\contosoroot_1.cer
  • <Drive name for removable media>:\testcertificate.cer
  • <Drive name for removable media>:\hanni_umami_chapter.doc
  • <Drive name for removable media>:\testee.cer
  • <Drive name for removable media>:\contosoroot.cer
  • <Drive name for removable media>:\sdkfailsafeemulator.cer
  • <Drive name for removable media>:\archer.avi
  • <Drive name for removable media>:\000814251_video_01.avi
  • <Drive name for removable media>:\contoso_1.cer
  • <Drive name for removable media>:\dial.bmp
  • <Drive name for removable media>:\dashborder_192.bmp
  • <Drive name for removable media>:\dashborder_144.bmp
  • <Drive name for removable media>:\toolbar.bmp
  • <Drive name for removable media>:\dashborder_120.bmp
  • <Drive name for removable media>:\dialmap.bmp
  • <Drive name for removable media>:\dashborder_96.bmp
  • <Drive name for removable media>:\ea98a5-readme.txt
  • <Drive name for removable media>:\roozenedowebinar.pptx
  • <Drive name for removable media>:\gruenspecht_02172016.pptx
Malicious functions
Reads files which store third party applications passwords
  • %HOMEPATH%\desktop\508softwareandos.doc
  • %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
  • %HOMEPATH%\desktop\split.avi
  • %HOMEPATH%\desktop\sdszfo.docx
  • %HOMEPATH%\desktop\ituneshelpunavailable.htm
  • %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
  • %HOMEPATH%\desktop\glidescope_review_rev_010.docx
  • %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
  • %HOMEPATH%\desktop\delete.avi
  • %HOMEPATH%\desktop\default.bmp
  • %HOMEPATH%\desktop\dashborder_96.bmp
  • %HOMEPATH%\desktop\dashborder_192.bmp
  • %HOMEPATH%\desktop\dashborder_120.bmp
  • %HOMEPATH%\desktop\cveuropeo.doc
  • %HOMEPATH%\desktop\contosoroot_1.cer
  • %HOMEPATH%\desktop\contosoroot.cer
  • %HOMEPATH%\desktop\contoso.cer
  • %HOMEPATH%\desktop\applicantform_en.doc
  • %HOMEPATH%\desktop\adhd_and_obesity.docx
  • %HOMEPATH%\desktop\64bit_notes.htm
  • %HOMEPATH%\desktop\toolbar.bmp
  • %HOMEPATH%\desktop\tree_view.htm
Modifies file system
Creates the following files
  • %TEMP%\h5s87rwd.0.cs
  • %LOCALAPPDATA%low\sun\java\deployment\ea98a5-readme.txt
  • %APPDATA%\adobe\acrobat\dc\jscache\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\ea98a5-readme.txt
  • %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\pepperflash\ea98a5-readme.txt
  • %APPDATA%\adobe\acrobat\dc\preferences\ea98a5-readme.txt
  • %APPDATA%\adobe\acrobat\dc\security\ea98a5-readme.txt
  • %APPDATA%\ghisler\ea98a5-readme.txt
  • %LOCALAPPDATA%low\adobe\acrobat\dc\ea98a5-readme.txt
  • %LOCALAPPDATA%\thunderbird\profiles\wjj9aet2.default\ea98a5-readme.txt
  • %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\ea98a5-readme.txt
  • %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\visualelements\ea98a5-readme.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\ea98a5-readme.txt
  • %ProgramFiles(x86)%\google\chrome\application\ea98a5-readme.txt
  • %APPDATA%\adobe\acrobat\dc\ea98a5-readme.txt
  • %APPDATA%\adobe\logtransport2\ea98a5-readme.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\ea98a5-readme.txt
  • %ProgramFiles(x86)%\k-lite codec pack\info\ea98a5-readme.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\adobe\ea98a5-readme.txt
  • %APPDATA%\adobe\acrobat\dc\security\crlcache\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\3082\ea98a5-readme.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_gb\ea98a5-readme.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_us\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\2052\ea98a5-readme.txt
  • %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\ea98a5-readme.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ea98a5-readme.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\ea98a5-readme.txt
  • %HOMEPATH%\searches\ea98a5-readme.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\ea98a5-readme.txt
  • %ProgramFiles(x86)%\microsoft office\office14\1033\ea98a5-readme.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\ea98a5-readme.txt
  • %ProgramFiles(x86)%\k-lite codec pack\icaros\ea98a5-readme.txt
  • %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft\network\downloader\ea98a5-readme.txt
  • %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\extensions\ea98a5-readme.txt
  • %LOCALAPPDATA%\thunderbird\profiles\wjj9aet2.default\startupcache\ea98a5-readme.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\pmp\ea98a5-readme.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\ea98a5-readme.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_ca\ea98a5-readme.txt
  • %APPDATA%\icq-profile\base\ea98a5-readme.txt
  • %ProgramFiles(x86)%\mirc\defaults\scripts\ea98a5-readme.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_ca\ea98a5-readme.txt
  • %ProgramFiles(x86)%\steam\config\ea98a5-readme.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_us\ea98a5-readme.txt
  • %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\ea98a5-readme.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\ea98a5-readme.txt
  • %ProgramFiles(x86)%\steam\controller_base\templates\ea98a5-readme.txt
  • %ProgramFiles(x86)%\steam\controller_base\ea98a5-readme.txt
  • %ProgramFiles(x86)%\steam\friends\ea98a5-readme.txt
  • %APPDATA%\mail.ru\agent\mra\fonts\ea98a5-readme.txt
  • %ProgramFiles(x86)%\steam\bin\shaders\ea98a5-readme.txt
  • %ProgramFiles(x86)%\steam\bin\ea98a5-readme.txt
  • %ProgramFiles(x86)%\steam\graphics\ea98a5-readme.txt
  • %ProgramFiles(x86)%\winamp\skins\bento\ea98a5-readme.txt
  • %ProgramFiles(x86)%\winamp\skins\bento\scripts\ea98a5-readme.txt
  • %ProgramFiles(x86)%\winamp\skins\bento\window\ea98a5-readme.txt
  • %ProgramFiles(x86)%\steam\bin\locales\ea98a5-readme.txt
  • %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\ea98a5-readme.txt
  • %APPDATA%\icq-profile\ea98a5-readme.txt
  • %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\ea98a5-readme.txt
  • %ProgramFiles(x86)%\winamp\components\ea98a5-readme.txt
  • %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\ea98a5-readme.txt
  • %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\ea98a5-readme.txt
  • %ProgramFiles(x86)%\microsoft.net\redistlist\ea98a5-readme.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\mpp\ea98a5-readme.txt
  • %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\solutiontemplates\ea98a5-readme.txt
  • %ProgramFiles(x86)%\steam\html5app\ea98a5-readme.txt
  • %APPDATA%\icq-profile\update\ea98a5-readme.txt
  • %ProgramFiles(x86)%\winamp\lang\ea98a5-readme.txt
  • %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\ea98a5-readme.txt
  • %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\ea98a5-readme.txt
  • %ProgramFiles(x86)%\qip 2012\skins\qip\clients\ea98a5-readme.txt
  • %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\ea98a5-readme.txt
  • %APPDATA%\mail.ru\agent\mra\database\ea98a5-readme.txt
  • %ProgramFiles(x86)%\opera\29.0.1795.47\ea98a5-readme.txt
  • %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\kiks.yandex.ru\ea98a5-readme.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_us\ea98a5-readme.txt
  • %ProgramFiles(x86)%\opera\assets\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1050\ea98a5-readme.txt
  • %LOCALAPPDATA%\thunderbird\profiles\wjj9aet2.default\cache\ea98a5-readme.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\locale\en_us\ea98a5-readme.txt
  • C:\far2\addons\ea98a5-readme.txt
  • C:\far2\fexcept\ea98a5-readme.txt
  • C:\far2\encyclopedia\ea98a5-readme.txt
  • C:\far2\plugins\proclist\ea98a5-readme.txt
  • C:\far2\plugins\emenu\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft\user account pictures\ea98a5-readme.txt
  • %ProgramFiles(x86)%\winamp\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\ea98a5-readme.txt
  • %ProgramFiles(x86)%\qip 2012\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft toolkit\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft help\ea98a5-readme.txt
  • C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\ea98a5-readme.txt
  • %ProgramFiles%\firefox\ea98a5-readme.txt
  • %ProgramFiles%\foxit\ea98a5-readme.txt
  • %ProgramFiles%\microsoft office\clipart\pub60cor\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\ea98a5-readme.txt
  • C:\far2\plugins\farcmds\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\ea98a5-readme.txt
  • %ProgramFiles(x86)%\opera\ea98a5-readme.txt
  • %TEMP%\res8c96.tmp
  • %TEMP%\h5s87rwd.out
  • %TEMP%\csc8813.tmp
  • %TEMP%\res8823.tmp
  • %TEMP%\h5s87rwd.dll
  • %TEMP%\jo5x_w7p.0.cs
  • %TEMP%\jo5x_w7p.cmdline
  • %ProgramFiles(x86)%\mirc\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\ea98a5-readme.txt
  • %TEMP%\h5s87rwd.cmdline
  • %TEMP%\jo5x_w7p.dll
  • D:\ea98a5-readme.txt
  • C:\far2\ea98a5-readme.txt
  • C:\totalcmd\ea98a5-readme.txt
  • %ProgramFiles(x86)%\k-lite codec pack\ea98a5-readme.txt
  • %ProgramFiles(x86)%\msbuild\ea98a5-readme.txt
  • %TEMP%\csc8c95.tmp
  • %TEMP%\jo5x_w7p.out
  • %ProgramFiles(x86)%\steam\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\ea98a5-readme.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1036\ea98a5-readme.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ea98a5-readme.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1041\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\oracle\java\installcache_x64\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1028\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1033\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1042\ea98a5-readme.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\ea98a5-readme.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\enu\ea98a5-readme.txt
  • %LOCALAPPDATA%\steam\htmlcache\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1046\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1049\ea98a5-readme.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\ea98a5-readme.txt
  • %CommonProgramFiles(x86)%\java\java update\ea98a5-readme.txt
  • %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1031\ea98a5-readme.txt
  • %ProgramFiles%\winrar\ea98a5-readme.txt
  • C:\totalcmd\language\ea98a5-readme.txt
  • %HOMEPATH%\desktop\ea98a5-readme.txt
  • %HOMEPATH%\contacts\ea98a5-readme.txt
  • C:\users\public\videos\sample videos\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\ea98a5-readme.txt
  • %HOMEPATH%\favorites\links\ea98a5-readme.txt
  • %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\ea98a5-readme.txt
  • %HOMEPATH%\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\ea98a5-readme.txt
  • %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\ea98a5-readme.txt
  • %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\1033\ea98a5-readme.txt
  • %HOMEPATH%\favorites\links for united states\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft\ilscache\ea98a5-readme.txt
  • %HOMEPATH%\favorites\microsoft websites\ea98a5-readme.txt
  • %ALLUSERSPROFILE%\microsoft\mf\ea98a5-readme.txt
  • %HOMEPATH%\favorites\msn websites\ea98a5-readme.txt
  • %HOMEPATH%\favorites\windows live\ea98a5-readme.txt
  • %LOCALAPPDATA%\opera software\opera stable\cache\ea98a5-readme.txt
  • %ProgramFiles(x86)%\steam\graphics\broadcast\ea98a5-readme.txt
  • %ProgramFiles(x86)%\winamp\skins\bento\xml\ea98a5-readme.txt
Deletes the following files
  • %TEMP%\res8823.tmp
  • %TEMP%\csc8813.tmp
  • %TEMP%\h5s87rwd.dll
  • %TEMP%\h5s87rwd.0.cs
  • %TEMP%\h5s87rwd.cmdline
  • %TEMP%\h5s87rwd.pdb
  • %TEMP%\h5s87rwd.out
  • %TEMP%\res8c96.tmp
  • %TEMP%\csc8c95.tmp
  • %TEMP%\jo5x_w7p.out
  • %TEMP%\jo5x_w7p.cmdline
  • %TEMP%\jo5x_w7p.0.cs
  • %TEMP%\jo5x_w7p.dll
  • %TEMP%\jo5x_w7p.pdb
Moves the following files
  • from %ProgramFiles(x86)%\mirc\readme.txt to %ProgramFiles(x86)%\mirc\readme.txt.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\tr.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\tr.gif.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\30-non-latin-inf-win.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\30-non-latin-inf-win.conf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00273_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00273_.wmf.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\dv_vjsharp.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\dv_vjsharp.hxi.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\tl.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\tl.gif.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\locales\ca.pak to %ProgramFiles(x86)%\steam\bin\locales\ca.pak.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00270_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00270_.wmf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\submission_history.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\submission_history.gif.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\curve.gif to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\curve.gif.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\locales\bn.pak to %ProgramFiles(x86)%\steam\bin\locales\bn.pak.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00269_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00269_.wmf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\stop_collection_data.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\stop_collection_data.gif.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\csspec.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\csspec.hxs.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\locales\bg.pak to %ProgramFiles(x86)%\steam\bin\locales\bg.pak.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00267_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00267_.wmf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_ok.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_ok.gif.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\csspec.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\csspec.hxi.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_lg.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_lg.gif.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\21-aliases-wine-win7-inf.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\21-aliases-wine-win7-inf.conf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_issue.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_issue.gif.ea98a5
  • from %ProgramFiles(x86)%\winamp\skins\bento\scripts\mcvcore.maki to %ProgramFiles(x86)%\winamp\skins\bento\scripts\mcvcore.maki.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\20-fix-cantarell.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\20-fix-cantarell.conf.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\snapshot_blob.bin to %ProgramFiles(x86)%\steam\bin\snapshot_blob.bin.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\achievementbg_recent.tga to %ProgramFiles(x86)%\steam\graphics\achievementbg_recent.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\avatarborderoffline.tga to %ProgramFiles(x86)%\steam\graphics\avatarborderoffline.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\debug.log to %ProgramFiles(x86)%\steam\bin\debug.log.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviews_joined.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviews_joined.gif.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\locales\cs.pak to %ProgramFiles(x86)%\steam\bin\locales\cs.pak.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\avatarborderonline.tga to %ProgramFiles(x86)%\steam\graphics\avatarborderonline.tga.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\sdkstart.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\sdkstart.hxs.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnonnotificationintray.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnonnotificationintray.gif.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnonnotificationinacrobat.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnonnotificationinacrobat.gif.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\sdkstart.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\sdkstart.hxi.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\broadcast\icon_close_hover.tga to %ProgramFiles(x86)%\steam\graphics\broadcast\icon_close_hover.tga.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnoffnotificationintray.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnoffnotificationintray.gif.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\broadcast\icon_close_default.tga to %ProgramFiles(x86)%\steam\graphics\broadcast\icon_close_default.tga.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\netsdknlinks.hxk to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\netsdknlinks.hxk.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnoffnotificationinacrobat.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnoffnotificationinacrobat.gif.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\netsdkklinks.hxk to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\netsdkklinks.hxk.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\netsdkflinks.hxk to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\netsdkflinks.hxk.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\netsdkalinks.hxk to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\netsdkalinks.hxk.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\mwsdk.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\mwsdk.hxs.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\44-repl-corrective.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\44-repl-corrective.conf.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btndefbottom.tga to %ProgramFiles(x86)%\steam\graphics\btndefbottom.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btndefbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btndefbottomleft.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\43-repl-tt-traced-bitmap.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\43-repl-tt-traced-bitmap.conf.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\mwsdk.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\mwsdk.hxi.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\mslogo.gif to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\mslogo.gif.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\42-repl-global.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\42-repl-global.conf.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\jscriptnet.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\jscriptnet.hxs.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\trash.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\trash.gif.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\41-repl-os-win.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\41-repl-os-win.conf.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\dv_vjsyntax.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\dv_vjsyntax.hxs.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\bg_security_wizard.tga to %ProgramFiles(x86)%\steam\graphics\bg_security_wizard.tga.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\dv_vjsharp.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\dv_vjsharp.hxs.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\bigpicturebg.tga to %ProgramFiles(x86)%\steam\graphics\bigpicturebg.tga.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\warning.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\warning.gif.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\mssdsp.flt to %ProgramFiles(x86)%\steam\bin\mssdsp.flt.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\locales\am.pak to %ProgramFiles(x86)%\steam\bin\locales\am.pak.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptools.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptools.hxs.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\info.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\info.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00152_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00152_.wmf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\form_responses.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\form_responses.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00148_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00148_.wmf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_super.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_super.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00130_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00130_.wmf.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptools.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptools.hxi.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_received.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_received.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00105_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00105_.wmf.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptools.chm to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptools.chm.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_distributed.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_distributed.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00098_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00098_.wmf.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpsamples.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpsamples.hxs.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\end_review.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\end_review.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00045_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00045_.wmf.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpsamples.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpsamples.hxi.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\ended_review_or_form.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\ended_review_or_form.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00012_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00012_.wmf.ea98a5
  • from %ProgramFiles(x86)%\steam\friends\claneventnotification.res to %ProgramFiles(x86)%\steam\friends\claneventnotification.res.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpref.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpref.hxs.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\email_initiator.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\email_initiator.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00008_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00008_.wmf.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpref.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpref.hxi.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\main.css to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\main.css.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\devtools_resources.pak to %ProgramFiles(x86)%\steam\bin\devtools_resources.pak.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00194_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00194_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00195_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00195_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00234_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00234_.wmf.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\natives_blob.bin to %ProgramFiles(x86)%\steam\bin\natives_blob.bin.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\mssmp3.asi to %ProgramFiles(x86)%\steam\bin\mssmp3.asi.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\20-aliases-default-win.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\20-aliases-default-win.conf.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\shaders\d3d10overlay.fxo to %ProgramFiles(x86)%\steam\bin\shaders\d3d10overlay.fxo.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00265_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00265_.wmf.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\csref.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\csref.hxs.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00262_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00262_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00261_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00261_.wmf.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\csref.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\csref.hxi.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00254_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00254_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00252_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00252_.wmf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviewers.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviewers.gif.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cscomp.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cscomp.hxs.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\pdf.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\pdf.gif.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cscomp.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cscomp.hxi.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\open_original_form.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\open_original_form.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00248_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00248_.wmf.ea98a5
  • from %APPDATA%\mail.ru\agent\mra\fonts\segoesc.ttf to %APPDATA%\mail.ru\agent\mra\fonts\segoesc.ttf.ea98a5
  • from %APPDATA%\mail.ru\agent\mra\database\citylist_ua.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_ua.csv.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00247_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00247_.wmf.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptutorials.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptutorials.hxs.ea98a5
  • from %ProgramFiles(x86)%\steam\friends\friendgameinvitedialog.res to %ProgramFiles(x86)%\steam\friends\friendgameinvitedialog.res.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00242_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00242_.wmf.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptutorials.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptutorials.hxi.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\mssvoice.asi to %ProgramFiles(x86)%\steam\bin\mssvoice.asi.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\peverify.exe.config to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\peverify.exe.config.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vblr7net.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vblr7net.hxi.ea98a5
  • from %ProgramFiles(x86)%\winamp\system\alac.w5s to %ProgramFiles(x86)%\winamp\system\alac.w5s.ea98a5
  • from %ProgramFiles(x86)%\winamp\system\aacdec.w5s to %ProgramFiles(x86)%\winamp\system\aacdec.w5s.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\creditcard_back.tga to %ProgramFiles(x86)%\steam\graphics\creditcard_back.tga.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\version.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\version.js.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\creditcard_back_amex.tga to %ProgramFiles(x86)%\steam\graphics\creditcard_back_amex.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\chkseldown.tga to %ProgramFiles(x86)%\steam\graphics\chkseldown.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\chkseldown_sm.tga to %ProgramFiles(x86)%\steam\graphics\chkseldown_sm.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\chkselfocus.tga to %ProgramFiles(x86)%\steam\graphics\chkselfocus.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\chkselfocus_sm.tga to %ProgramFiles(x86)%\steam\graphics\chkselfocus_sm.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\chkselstd.tga to %ProgramFiles(x86)%\steam\graphics\chkselstd.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\chkselstd_sm.tga to %ProgramFiles(x86)%\steam\graphics\chkselstd_sm.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\chkunseldis_sm.tga to %ProgramFiles(x86)%\steam\graphics\chkunseldis_sm.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\chkunselfocus.tga to %ProgramFiles(x86)%\steam\graphics\chkunselfocus.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\chkaeldis_sm.tga to %ProgramFiles(x86)%\steam\graphics\chkaeldis_sm.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\chkindeterminate.tga to %ProgramFiles(x86)%\steam\graphics\chkindeterminate.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\chkseldis.tga to %ProgramFiles(x86)%\steam\graphics\chkseldis.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\friends\voice_hang_up.wav to %ProgramFiles(x86)%\steam\friends\voice_hang_up.wav.ea98a5
  • from %ProgramFiles(x86)%\winamp\system\adpcm.w5s to %ProgramFiles(x86)%\winamp\system\adpcm.w5s.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnstdtop.tga to %ProgramFiles(x86)%\steam\graphics\btnstdtop.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnstdtopleft.tga to %ProgramFiles(x86)%\steam\graphics\btnstdtopleft.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\friends\tradeinvitebar.res to %ProgramFiles(x86)%\steam\friends\tradeinvitebar.res.ea98a5
  • from %ProgramFiles(x86)%\steam\friends\voicebar.res to %ProgramFiles(x86)%\steam\friends\voicebar.res.ea98a5
  • from %ProgramFiles(x86)%\steam\friends\voicechatinvitenotification.res to %ProgramFiles(x86)%\steam\friends\voicechatinvitenotification.res.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\fonts.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\fonts.conf.ea98a5
  • from %ProgramFiles(x86)%\steam\friends\trackerui_norwegian.txt to %ProgramFiles(x86)%\steam\friends\trackerui_norwegian.txt.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\locales\fa.pak to %ProgramFiles(x86)%\steam\bin\locales\fa.pak.ea98a5
  • from %ProgramFiles(x86)%\winamp\system\albumart.w5s to %ProgramFiles(x86)%\winamp\system\albumart.w5s.ea98a5
  • from %ProgramFiles(x86)%\winamp\system\adpcm.wbm to %ProgramFiles(x86)%\winamp\system\adpcm.wbm.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\cloud_uhoh.tga to %ProgramFiles(x86)%\steam\graphics\cloud_uhoh.tga.ea98a5
  • from %ProgramFiles(x86)%\winamp\system\aacdec.wbm to %ProgramFiles(x86)%\winamp\system\aacdec.wbm.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\facebooklogo12.tga to %ProgramFiles(x86)%\steam\graphics\facebooklogo12.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\emailreminder_close.tga to %ProgramFiles(x86)%\steam\graphics\emailreminder_close.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\find_icon_down.tga to %ProgramFiles(x86)%\steam\graphics\find_icon_down.tga.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corsym.idl to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corsym.idl.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\downloads_bg.tga to %ProgramFiles(x86)%\steam\graphics\downloads_bg.tga.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corsym.h to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corsym.h.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corsvc.idl to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corsvc.idl.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corsvc.h to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corsvc.h.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corpub.idl to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corpub.idl.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corpub.h to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corpub.h.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corprof.idl to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corprof.idl.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corprof.h to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corprof.h.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corhlpr.cpp to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corhlpr.cpp.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btndefright.tga to %ProgramFiles(x86)%\steam\graphics\btndefright.tga.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corhdr.h to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corhdr.h.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corerror.h to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corerror.h.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\cordebug.idl to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\cordebug.idl.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\cordebug.h to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\cordebug.h.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\cor.h to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\cor.h.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\guidebug\msdis140.pdb to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\guidebug\msdis140.pdb.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\guidebug\dbgclr.exe.config to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\guidebug\dbgclr.exe.config.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\chkunselfocus_sm.tga to %ProgramFiles(x86)%\steam\graphics\chkunselfocus_sm.tga.ea98a5
  • from %ProgramFiles(x86)%\winamp\system\alac.wbm to %ProgramFiles(x86)%\winamp\system\alac.wbm.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\cloud_localfiles.tga to %ProgramFiles(x86)%\steam\graphics\cloud_localfiles.tga.ea98a5
  • from %ProgramFiles(x86)%\winamp\system\auth.w5s to %ProgramFiles(x86)%\winamp\system\auth.w5s.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\find_icon_down_hover.tga to %ProgramFiles(x86)%\steam\graphics\find_icon_down_hover.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnseltop.tga to %ProgramFiles(x86)%\steam\graphics\btnseltop.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnseltopleft.tga to %ProgramFiles(x86)%\steam\graphics\btnseltopleft.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\friends\newturnsnotification.res to %ProgramFiles(x86)%\steam\friends\newturnsnotification.res.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\90-reject.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\90-reject.conf.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\locales\es-419.pak to %ProgramFiles(x86)%\steam\bin\locales\es-419.pak.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vccore.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vccore.hxi.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\90-no-synthetic.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\90-no-synthetic.conf.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\locales\en-us.pak to %ProgramFiles(x86)%\steam\bin\locales\en-us.pak.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\locales\en-gb.pak to %ProgramFiles(x86)%\steam\bin\locales\en-gb.pak.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\81-final-rendering-inf-7-xp.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\81-final-rendering-inf-7-xp.conf.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\locales\el.pak to %ProgramFiles(x86)%\steam\bin\locales\el.pak.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vblsnet.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vblsnet.hxs.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\60-group-tt-fonts.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\60-group-tt-fonts.conf.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\locales\de.pak to %ProgramFiles(x86)%\steam\bin\locales\de.pak.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vblsnet.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vblsnet.hxi.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\60-group-non-tt-fonts.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\60-group-non-tt-fonts.conf.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\locales\da.pak to %ProgramFiles(x86)%\steam\bin\locales\da.pak.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00274_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00274_.wmf.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btndeftop.tga to %ProgramFiles(x86)%\steam\graphics\btndeftop.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btndeftopleft.tga to %ProgramFiles(x86)%\steam\graphics\btndeftopleft.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btndeftopright.tga to %ProgramFiles(x86)%\steam\graphics\btndeftopright.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btndisbottom.tga to %ProgramFiles(x86)%\steam\graphics\btndisbottom.tga.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vblr7net.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vblr7net.hxs.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\base_uris.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\base_uris.js.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\50-base-rendering-win7-winxp.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\50-base-rendering-win7-winxp.conf.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btndefleft.tga to %ProgramFiles(x86)%\steam\graphics\btndefleft.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\friends\rampup_2.tga to %ProgramFiles(x86)%\steam\friends\rampup_2.tga.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\init.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\init.js.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\locales\et.pak to %ProgramFiles(x86)%\steam\bin\locales\et.pak.ea98a5
  • from %ProgramFiles(x86)%\steam\bin\locales\es.pak to %ProgramFiles(x86)%\steam\bin\locales\es.pak.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\variant.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\variant.js.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnstdbottom.tga to %ProgramFiles(x86)%\steam\graphics\btnstdbottom.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnseltopright.tga to %ProgramFiles(x86)%\steam\graphics\btnseltopright.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnstdbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btnstdbottomleft.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnstdbottomright.tga to %ProgramFiles(x86)%\steam\graphics\btnstdbottomright.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnstdleft.tga to %ProgramFiles(x86)%\steam\graphics\btnstdleft.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnstdright.tga to %ProgramFiles(x86)%\steam\graphics\btnstdright.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnovrontop.tga to %ProgramFiles(x86)%\steam\graphics\btnovrontop.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnselbottom.tga to %ProgramFiles(x86)%\steam\graphics\btnselbottom.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnselbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btnselbottomleft.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnselbottomright.tga to %ProgramFiles(x86)%\steam\graphics\btnselbottomright.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnselleft.tga to %ProgramFiles(x86)%\steam\graphics\btnselleft.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnselright.tga to %ProgramFiles(x86)%\steam\graphics\btnselright.tga.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd20013_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd20013_.wmf.ea98a5
  • from %ProgramFiles(x86)%\steam\friends\claninvitationnotification.res to %ProgramFiles(x86)%\steam\friends\claninvitationnotification.res.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnovroffright.tga to %ProgramFiles(x86)%\steam\graphics\btnovroffright.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnovrofftopright.tga to %ProgramFiles(x86)%\steam\graphics\btnovrofftopright.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnovronbottom.tga to %ProgramFiles(x86)%\steam\graphics\btnovronbottom.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnovronbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovronbottomleft.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnovronbottomright.tga to %ProgramFiles(x86)%\steam\graphics\btnovronbottomright.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnovronleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovronleft.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnovronright.tga to %ProgramFiles(x86)%\steam\graphics\btnovronright.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnovroffbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovroffbottomleft.tga.ea98a5
  • from %ProgramFiles(x86)%\winamp\plugins\winampflv.swf to %ProgramFiles(x86)%\winamp\plugins\winampflv.swf.ea98a5
  • from %ProgramFiles(x86)%\steam\friends\subpanelfindbuddy.res to %ProgramFiles(x86)%\steam\friends\subpanelfindbuddy.res.ea98a5
  • from %ProgramFiles(x86)%\steam\friends\subpaneluserinfodetails.res to %ProgramFiles(x86)%\steam\friends\subpaneluserinfodetails.res.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vccore.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vccore.hxs.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnovrofftop.tga to %ProgramFiles(x86)%\steam\graphics\btnovrofftop.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\btnovrofftopleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovrofftopleft.tga.ea98a5
  • from %ProgramFiles(x86)%\steam\controller_base\videoplayer.vdf to %ProgramFiles(x86)%\steam\controller_base\videoplayer.vdf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\distribute_form.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\distribute_form.gif.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpqstart.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpqstart.hxs.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an02724_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an02724_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00173_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00173_.wmf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00160_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00160_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00155_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00155_.wmf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00146_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00146_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00141_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00141_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00116_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00116_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\baby_01.mid to %ProgramFiles%\microsoft office\clipart\pub60cor\baby_01.mid.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an04384_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04384_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an04369_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04369_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an04355_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04355_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an04332_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04332_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an04326_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04326_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an04323_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04323_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an04206_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04206_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an04196_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04196_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an04195_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04195_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an04191_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04191_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an04174_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04174_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an04134_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04134_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an04117_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04117_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an04108_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04108_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an03500_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an03500_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an02122_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an02122_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd05119_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd05119_.wmf.ea98a5
  • from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd06200_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd06200_.wmf.ea98a5
  • from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome_100_percent.pak to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome_100_percent.pak.ea98a5
  • from %APPDATA%\adobe\acrobat\dc\jscache\globsettings to %APPDATA%\adobe\acrobat\dc\jscache\globsettings.ea98a5
  • from %APPDATA%\adobe\acrobat\dc\jscache\globdata to %APPDATA%\adobe\acrobat\dc\jscache\globdata.ea98a5
  • from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\nacl_irt_x86_32.nexe to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\nacl_irt_x86_32.nexe.ea98a5
  • from %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm to %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm.ea98a5
  • from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\extensions\external_extensions.json to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\extensions\external_extensions.json.ea98a5
  • from %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt.ea98a5
  • from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\search.crx to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\search.crx.ea98a5
  • from %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\icarosdescriptions.propdesc to %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\icarosdescriptions.propdesc.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api.ea98a5
  • from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\gmail.crx to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\gmail.crx.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08808_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08808_.wmf.ea98a5
  • from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\external_extensions.json to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\external_extensions.json.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08773_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08773_.wmf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\pmp\adobepdf417.pmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\pmp\adobepdf417.pmp.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\adobepdf.xdc to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\adobepdf.xdc.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\accessibility.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\accessibility.api.ea98a5
  • from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\drive.crx to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\drive.crx.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08758_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08758_.wmf.ea98a5
  • from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\docs.crx to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\docs.crx.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd07831_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd07831_.wmf.ea98a5
  • from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome_200_percent.pak to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome_200_percent.pak.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd07804_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd07804_.wmf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\locale\en_us\stopwords.enu to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\locale\en_us\stopwords.enu.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd07761_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd07761_.wmf.ea98a5
  • from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\natives_blob.bin to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\natives_blob.bin.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an02559_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an02559_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an01545_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01545_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an00914_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00914_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif.ea98a5
  • from %ProgramFiles%\firefox\softokn3.chk to %ProgramFiles%\firefox\softokn3.chk.ea98a5
  • from %ProgramFiles%\firefox\updater.ini to %ProgramFiles%\firefox\updater.ini.ea98a5
  • from %ProgramFiles%\firefox\readme.txt to %ProgramFiles%\firefox\readme.txt.ea98a5
  • from %ProgramFiles%\firefox\update.locale to %ProgramFiles%\firefox\update.locale.ea98a5
  • from %ProgramFiles%\foxit\foxit to %ProgramFiles%\foxit\foxit.ea98a5
  • from %ProgramFiles%\firefox\application.ini to %ProgramFiles%\firefox\application.ini.ea98a5
  • from %ProgramFiles(x86)%\steam\libx264-142.dll.md5 to %ProgramFiles(x86)%\steam\libx264-142.dll.md5.ea98a5
  • from %ProgramFiles(x86)%\steam\libav_h264-56.dll.md5 to %ProgramFiles(x86)%\steam\libav_h264-56.dll.md5.ea98a5
  • from %ProgramFiles(x86)%\winamp\whatsnew.txt to %ProgramFiles(x86)%\winamp\whatsnew.txt.ea98a5
  • from %ProgramFiles(x86)%\winamp\paths.ini to %ProgramFiles(x86)%\winamp\paths.ini.ea98a5
  • from %ProgramFiles(x86)%\winamp\install.ini to %ProgramFiles(x86)%\winamp\install.ini.ea98a5
  • from %ProgramFiles(x86)%\winamp\pconfig.dcf to %ProgramFiles(x86)%\winamp\pconfig.dcf.ea98a5
  • from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\unins000.msg.ea98a5
  • from %ProgramFiles(x86)%\opera\installer_prefs.json to %ProgramFiles(x86)%\opera\installer_prefs.json.ea98a5
  • from %ProgramFiles(x86)%\opera\resources.pri to %ProgramFiles(x86)%\opera\resources.pri.ea98a5
  • from %ProgramFiles(x86)%\opera\server_tracking_data to %ProgramFiles(x86)%\opera\server_tracking_data.ea98a5
  • from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets.ea98a5
  • from %ProgramFiles(x86)%\mirc\mirc.chm to %ProgramFiles(x86)%\mirc\mirc.chm.ea98a5
  • from %ProgramFiles(x86)%\mirc\versions.txt to %ProgramFiles(x86)%\mirc\versions.txt.ea98a5
  • from %ProgramFiles(x86)%\mirc\ircintro.chm to %ProgramFiles(x86)%\mirc\ircintro.chm.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif.ea98a5
  • from %ProgramFiles%\winrar\default64.sfx to %ProgramFiles%\winrar\default64.sfx.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00092_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00092_.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an01251_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01251_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an01218_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01218_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an01216_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01216_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an01184_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01184_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an01174_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01174_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an01173_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01173_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an01084_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01084_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an01060_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01060_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an01044_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01044_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an01039_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01039_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an00965_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00965_.wmf.ea98a5
  • from %ProgramFiles(x86)%\steam\graphics\facebooklogo140.tga to %ProgramFiles(x86)%\steam\graphics\facebooklogo140.tga.ea98a5
  • from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\pepperflash\manifest.json to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\pepperflash\manifest.json.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an00853_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00853_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an00790_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00790_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an00015_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00015_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an00010_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00010_.wmf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00176_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00176_.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00175_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00175_.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00161_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00161_.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00160_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00160_.gif.ea98a5
  • from %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\1033\synchronization.rll to %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\1033\synchronization.rll.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif.ea98a5
  • from %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets to %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets.ea98a5
  • from %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets to %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\an00932_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00932_.wmf.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corhlpr.h to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corhlpr.h.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08868_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08868_.wmf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ia32.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ia32.api.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09664_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09664_.wmf.ea98a5
  • from %ProgramFiles(x86)%\steam\controller_base\app_generic.vdf to %ProgramFiles(x86)%\steam\controller_base\app_generic.vdf.ea98a5
  • from %ProgramFiles(x86)%\winamp\lang\winamp-tr-tr.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-tr-tr.wlz.ea98a5
  • from %ProgramFiles(x86)%\winamp\lang\winamp-zh-cn.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-zh-cn.wlz.ea98a5
  • from %ProgramFiles(x86)%\winamp\lang\winamp-zh-tw.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-zh-tw.wlz.ea98a5
  • from %ProgramFiles(x86)%\winamp\lang\winamp-sv-se.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-sv-se.wlz.ea98a5
  • from %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt to %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt.ea98a5
  • from %ProgramFiles(x86)%\steam\libx264-142.dll.crypt to %ProgramFiles(x86)%\steam\libx264-142.dll.crypt.ea98a5
  • from %ProgramFiles(x86)%\steam\html5app\keybinds.cfg to %ProgramFiles(x86)%\steam\html5app\keybinds.cfg.ea98a5
  • from %ProgramFiles(x86)%\winamp\lang\winamp-nl-nl.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-nl-nl.wlz.ea98a5
  • from %ProgramFiles(x86)%\winamp\lang\winamp-pl-pl.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-pl-pl.wlz.ea98a5
  • from %ProgramFiles(x86)%\winamp\lang\winamp-id-id.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-id-id.wlz.ea98a5
  • from %ProgramFiles(x86)%\winamp\lang\winamp-es-us.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-es-us.wlz.ea98a5
  • from %ProgramFiles(x86)%\winamp\components\ssdp.w6c to %ProgramFiles(x86)%\winamp\components\ssdp.w6c.ea98a5
  • from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_125_percent.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\opera_125_percent.pak.ea98a5
  • from %ProgramFiles(x86)%\opera\29.0.1795.47\snapshot_blob.bin to %ProgramFiles(x86)%\opera\29.0.1795.47\snapshot_blob.bin.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\updater.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\updater.api.ea98a5
  • from %APPDATA%\mail.ru\agent\mra\database\citylist_tr.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_tr.csv.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19563_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19563_.gif.ea98a5
  • from %ProgramFiles(x86)%\opera\29.0.1795.47\opera.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\opera.pak.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpgenref.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpgenref.hxi.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\spelling.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\spelling.api.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd10972_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd10972_.gif.ea98a5
  • from %APPDATA%\mail.ru\agent\mra\database\citylist_ru.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_ru.csv.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd10890_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd10890_.gif.ea98a5
  • from %ProgramFiles(x86)%\steam\config\config.vdf to %ProgramFiles(x86)%\steam\config\config.vdf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\sendmail.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\sendmail.api.ea98a5
  • from %ProgramFiles(x86)%\steam\friends\broadcastapprovenotification.res to %ProgramFiles(x86)%\steam\friends\broadcastapprovenotification.res.ea98a5
  • from %ProgramFiles(x86)%\steam\friends\broadcastrecordererrornotification.res to %ProgramFiles(x86)%\steam\friends\broadcastrecordererrornotification.res.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\add_reviewer.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\add_reviewer.gif.ea98a5
  • from %ProgramFiles(x86)%\steam\controller_base\templates\wasd.vdf to %ProgramFiles(x86)%\steam\controller_base\templates\wasd.vdf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\create_form.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\create_form.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19986_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19986_.wmf.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpqstart.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpqstart.hxi.ea98a5
  • from %ProgramFiles(x86)%\steam\controller_base\templates\gamepad_joystick.vdf to %ProgramFiles(x86)%\steam\controller_base\templates\gamepad_joystick.vdf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\br.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\br.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19828_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19828_.wmf.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpguidenf.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpguidenf.hxs.ea98a5
  • from %ProgramFiles(x86)%\steam\controller_base\templates\gamepad_fps.vdf to %ProgramFiles(x86)%\steam\controller_base\templates\gamepad_fps.vdf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19827_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19827_.wmf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\bl.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\bl.gif.ea98a5
  • from %ProgramFiles(x86)%\steam\controller_base\templates\gamepad+mouse.vdf to %ProgramFiles(x86)%\steam\controller_base\templates\gamepad+mouse.vdf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19695_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19695_.wmf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\enu\eula.ini to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\enu\eula.ini.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpguidenf.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpguidenf.hxi.ea98a5
  • from %ProgramFiles(x86)%\steam\controller_base\streamingclient_gyro.vdf to %ProgramFiles(x86)%\steam\controller_base\streamingclient_gyro.vdf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpgenref.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpgenref.hxs.ea98a5
  • from %ProgramFiles(x86)%\steam\controller_base\streamingclient_bigpicture.vdf to %ProgramFiles(x86)%\steam\controller_base\streamingclient_bigpicture.vdf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19582_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19582_.gif.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\weblink.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\weblink.api.ea98a5
  • from %ProgramFiles(x86)%\steam\friends\chaturlwarningdialog.res to %ProgramFiles(x86)%\steam\friends\chaturlwarningdialog.res.ea98a5
  • from %ProgramFiles(x86)%\steam\controller_base\streamingclient.vdf to %ProgramFiles(x86)%\steam\controller_base\streamingclient.vdf.ea98a5
  • from %ProgramFiles(x86)%\steam\html5app\package.json to %ProgramFiles(x86)%\steam\html5app\package.json.ea98a5
  • from %ProgramFiles(x86)%\steam\friends\addfriendenterdetailssubpanel.res to %ProgramFiles(x86)%\steam\friends\addfriendenterdetailssubpanel.res.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\complus.gif to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\complus.gif.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\search.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\search.api.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\commoner.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\commoner.hxs.ea98a5
  • from %APPDATA%\icq-profile\update\languages.aff to %APPDATA%\icq-profile\update\languages.aff.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ebook.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ebook.api.ea98a5
  • from %APPDATA%\icq-profile\base\opt.dbs to %APPDATA%\icq-profile\base\opt.dbs.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\digsig.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\digsig.api.ea98a5
  • from %APPDATA%\icq-profile\base\mra.dbs to %APPDATA%\icq-profile\base\mra.dbs.ea98a5
  • from %APPDATA%\ghisler\wincmd.ini to %APPDATA%\ghisler\wincmd.ini.ea98a5
  • from %APPDATA%\adobe\logtransport2\logtransport2.cfg to %APPDATA%\adobe\logtransport2\logtransport2.cfg.ea98a5
  • from %APPDATA%\adobe\acrobat\dc\tmgrpprm.sav to %APPDATA%\adobe\acrobat\dc\tmgrpprm.sav.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\checkers.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\checkers.api.ea98a5
  • from %APPDATA%\adobe\acrobat\dc\tmdocs.sav to %APPDATA%\adobe\acrobat\dc\tmdocs.sav.ea98a5
  • from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll.ea98a5
  • from %APPDATA%\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl to %APPDATA%\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl.ea98a5
  • from %ProgramFiles(x86)%\google\chrome\application\debug.log to %ProgramFiles(x86)%\google\chrome\application\debug.log.ea98a5
  • from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sybase.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sybase.xsl.ea98a5
  • from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sql90.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sql90.xsl.ea98a5
  • from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sql70.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sql70.xsl.ea98a5
  • from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sql2000.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sql2000.xsl.ea98a5
  • from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\msjet.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\msjet.xsl.ea98a5
  • from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\informix.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\informix.xsl.ea98a5
  • from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\snapshot_blob.bin to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\snapshot_blob.bin.ea98a5
  • from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\as90.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\as90.xsl.ea98a5
  • from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\as80.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\as80.xsl.ea98a5
  • from %ProgramFiles(x86)%\k-lite codec pack\info\faq.css to %ProgramFiles(x86)%\k-lite codec pack\info\faq.css.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annots.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annots.api.ea98a5
  • from %APPDATA%\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl to %APPDATA%\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\escript.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\escript.api.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\makeaccessible.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\makeaccessible.api.ea98a5
  • from %APPDATA%\mail.ru\agent\mra\database\citylist_en.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_en.csv.ea98a5
  • from %APPDATA%\icq-profile\update\ver.txt to %APPDATA%\icq-profile\update\ver.txt.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09662_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09662_.wmf.ea98a5
  • from %APPDATA%\icq-profile\update\languages.hash to %APPDATA%\icq-profile\update\languages.hash.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\commoner.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\commoner.hxi.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\1pix.gif to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\1pix.gif.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09194_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09194_.wmf.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\reflow.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\reflow.api.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\wsdl.exe.config to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\wsdl.exe.config.ea98a5
  • from %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\visualui.ttf to %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\visualui.ttf.ea98a5
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09031_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09031_.wmf.ea98a5
  • from %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\kiks.yandex.ru\fuid01.sol to %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\kiks.yandex.ru\fuid01.sol.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\readoutloud.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\readoutloud.api.ea98a5
  • from %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\solutiontemplates\blank.vsdir to %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\solutiontemplates\blank.vsdir.ea98a5
  • from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\resources.pak to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\resources.pak.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ppklite.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ppklite.api.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\soapsuds.exe.config to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\soapsuds.exe.config.ea98a5
  • from %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\solutiontemplates\blank.sln to %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\solutiontemplates\blank.sln.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pddom.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pddom.api.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\microsoft.visualstudio.ldo to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\microsoft.visualstudio.ldo.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia.api.ea98a5
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\mpp\mcimpp.mpp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\mpp\mcimpp.mpp.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\ildasm.exe.config to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\ildasm.exe.config.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\gacutil.exe.config to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\gacutil.exe.config.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\dasmhlp.cnt to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\dasmhlp.cnt.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\cordbg.exe.config to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\cordbg.exe.config.ea98a5
  • from %ProgramFiles(x86)%\mirc\defaults\scripts\aliases.ini to %ProgramFiles(x86)%\mirc\defaults\scripts\aliases.ini.ea98a5
  • from %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets to %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets.ea98a5
  • from %APPDATA%\adobe\acrobat\dc\security\addressbook.acrodata to %APPDATA%\adobe\acrobat\dc\security\addressbook.acrodata.ea98a5
  • from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\mscoree.idl to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\mscoree.idl.ea98a5
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\h5s87rwd.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8823.tmp" "%TEMP%\CSC8813.tmp"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\jo5x_w7p.cmdline"' (with hidden window)
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8C96.tmp" "%TEMP%\CSC8C95.tmp"' (with hidden window)
Executes the following
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\h5s87rwd.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8823.tmp" "%TEMP%\CSC8813.tmp"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\jo5x_w7p.cmdline"
  • '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8C96.tmp" "%TEMP%\CSC8C95.tmp"

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android