Trojan.Encoder.32799

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\asaprojectcompetition.pptx
<Drive name for removable media>:\february_catalogue__2015.doc
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\ovp25012015.doc
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\hanni_umami_chapter.doc
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\archer.avi
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\ea98a5-readme.txt
<Drive name for removable media>:\roozenedowebinar.pptx
<Drive name for removable media>:\gruenspecht_02172016.pptx

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\ituneshelpunavailable.htm
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\64bit_notes.htm
%HOMEPATH%\desktop\toolbar.bmp
%HOMEPATH%\desktop\tree_view.htm

Modifies file system

Creates the following files

%TEMP%\h5s87rwd.0.cs
%LOCALAPPDATA%low\sun\java\deployment\ea98a5-readme.txt
%APPDATA%\adobe\acrobat\dc\jscache\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\ea98a5-readme.txt
%ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\pepperflash\ea98a5-readme.txt
%APPDATA%\adobe\acrobat\dc\preferences\ea98a5-readme.txt
%APPDATA%\adobe\acrobat\dc\security\ea98a5-readme.txt
%APPDATA%\ghisler\ea98a5-readme.txt
%LOCALAPPDATA%low\adobe\acrobat\dc\ea98a5-readme.txt
%LOCALAPPDATA%\thunderbird\profiles\wjj9aet2.default\ea98a5-readme.txt
%ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\ea98a5-readme.txt
%ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\visualelements\ea98a5-readme.txt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\ea98a5-readme.txt
%ProgramFiles(x86)%\google\chrome\application\ea98a5-readme.txt
%APPDATA%\adobe\acrobat\dc\ea98a5-readme.txt
%APPDATA%\adobe\logtransport2\ea98a5-readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\ea98a5-readme.txt
%ProgramFiles(x86)%\k-lite codec pack\info\ea98a5-readme.txt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\adobe\ea98a5-readme.txt
%APPDATA%\adobe\acrobat\dc\security\crlcache\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\3082\ea98a5-readme.txt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_gb\ea98a5-readme.txt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_us\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\2052\ea98a5-readme.txt
%ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\ea98a5-readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ea98a5-readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\ea98a5-readme.txt
%HOMEPATH%\searches\ea98a5-readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\ea98a5-readme.txt
%ProgramFiles(x86)%\microsoft office\office14\1033\ea98a5-readme.txt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\ea98a5-readme.txt
%ProgramFiles(x86)%\k-lite codec pack\icaros\ea98a5-readme.txt
%ProgramFiles(x86)%\k-lite codec pack\icaros\resources\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft\network\downloader\ea98a5-readme.txt
%ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\extensions\ea98a5-readme.txt
%LOCALAPPDATA%\thunderbird\profiles\wjj9aet2.default\startupcache\ea98a5-readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\pmp\ea98a5-readme.txt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\ea98a5-readme.txt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_ca\ea98a5-readme.txt
%APPDATA%\icq-profile\base\ea98a5-readme.txt
%ProgramFiles(x86)%\mirc\defaults\scripts\ea98a5-readme.txt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_ca\ea98a5-readme.txt
%ProgramFiles(x86)%\steam\config\ea98a5-readme.txt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_us\ea98a5-readme.txt
%ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\ea98a5-readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\ea98a5-readme.txt
%ProgramFiles(x86)%\steam\controller_base\templates\ea98a5-readme.txt
%ProgramFiles(x86)%\steam\controller_base\ea98a5-readme.txt
%ProgramFiles(x86)%\steam\friends\ea98a5-readme.txt
%APPDATA%\mail.ru\agent\mra\fonts\ea98a5-readme.txt
%ProgramFiles(x86)%\steam\bin\shaders\ea98a5-readme.txt
%ProgramFiles(x86)%\steam\bin\ea98a5-readme.txt
%ProgramFiles(x86)%\steam\graphics\ea98a5-readme.txt
%ProgramFiles(x86)%\winamp\skins\bento\ea98a5-readme.txt
%ProgramFiles(x86)%\winamp\skins\bento\scripts\ea98a5-readme.txt
%ProgramFiles(x86)%\winamp\skins\bento\window\ea98a5-readme.txt
%ProgramFiles(x86)%\steam\bin\locales\ea98a5-readme.txt
%ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\ea98a5-readme.txt
%APPDATA%\icq-profile\ea98a5-readme.txt
%ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\ea98a5-readme.txt
%ProgramFiles(x86)%\winamp\components\ea98a5-readme.txt
%ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\ea98a5-readme.txt
%ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\ea98a5-readme.txt
%ProgramFiles(x86)%\microsoft.net\redistlist\ea98a5-readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\mpp\ea98a5-readme.txt
%ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\solutiontemplates\ea98a5-readme.txt
%ProgramFiles(x86)%\steam\html5app\ea98a5-readme.txt
%APPDATA%\icq-profile\update\ea98a5-readme.txt
%ProgramFiles(x86)%\winamp\lang\ea98a5-readme.txt
%ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\ea98a5-readme.txt
%ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\ea98a5-readme.txt
%ProgramFiles(x86)%\qip 2012\skins\qip\clients\ea98a5-readme.txt
%ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\ea98a5-readme.txt
%APPDATA%\mail.ru\agent\mra\database\ea98a5-readme.txt
%ProgramFiles(x86)%\opera\29.0.1795.47\ea98a5-readme.txt
%APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\kiks.yandex.ru\ea98a5-readme.txt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_us\ea98a5-readme.txt
%ProgramFiles(x86)%\opera\assets\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1050\ea98a5-readme.txt
%LOCALAPPDATA%\thunderbird\profiles\wjj9aet2.default\cache\ea98a5-readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\locale\en_us\ea98a5-readme.txt
C:\far2\addons\ea98a5-readme.txt
C:\far2\fexcept\ea98a5-readme.txt
C:\far2\encyclopedia\ea98a5-readme.txt
C:\far2\plugins\proclist\ea98a5-readme.txt
C:\far2\plugins\emenu\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\ea98a5-readme.txt
%ProgramFiles(x86)%\winamp\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\ea98a5-readme.txt
%ProgramFiles(x86)%\qip 2012\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft toolkit\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft help\ea98a5-readme.txt
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\ea98a5-readme.txt
%ProgramFiles%\firefox\ea98a5-readme.txt
%ProgramFiles%\foxit\ea98a5-readme.txt
%ProgramFiles%\microsoft office\clipart\pub60cor\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\ea98a5-readme.txt
C:\far2\plugins\farcmds\ea98a5-readme.txt
%ALLUSERSPROFILE%\ea98a5-readme.txt
%ProgramFiles(x86)%\opera\ea98a5-readme.txt
%TEMP%\res8c96.tmp
%TEMP%\h5s87rwd.out
%TEMP%\csc8813.tmp
%TEMP%\res8823.tmp
%TEMP%\h5s87rwd.dll
%TEMP%\jo5x_w7p.0.cs
%TEMP%\jo5x_w7p.cmdline
%ProgramFiles(x86)%\mirc\ea98a5-readme.txt
%ALLUSERSPROFILE%\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\ea98a5-readme.txt
%TEMP%\h5s87rwd.cmdline
%TEMP%\jo5x_w7p.dll
D:\ea98a5-readme.txt
C:\far2\ea98a5-readme.txt
C:\totalcmd\ea98a5-readme.txt
%ProgramFiles(x86)%\k-lite codec pack\ea98a5-readme.txt
%ProgramFiles(x86)%\msbuild\ea98a5-readme.txt
%TEMP%\csc8c95.tmp
%TEMP%\jo5x_w7p.out
%ProgramFiles(x86)%\steam\ea98a5-readme.txt
%ALLUSERSPROFILE%\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\ea98a5-readme.txt
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\ea98a5-readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1036\ea98a5-readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ea98a5-readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1041\ea98a5-readme.txt
%ALLUSERSPROFILE%\oracle\java\installcache_x64\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1028\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1033\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1042\ea98a5-readme.txt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\ea98a5-readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\enu\ea98a5-readme.txt
%LOCALAPPDATA%\steam\htmlcache\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1046\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1049\ea98a5-readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\ea98a5-readme.txt
%CommonProgramFiles(x86)%\java\java update\ea98a5-readme.txt
%ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1031\ea98a5-readme.txt
%ProgramFiles%\winrar\ea98a5-readme.txt
C:\totalcmd\language\ea98a5-readme.txt
%HOMEPATH%\desktop\ea98a5-readme.txt
%HOMEPATH%\contacts\ea98a5-readme.txt
C:\users\public\videos\sample videos\ea98a5-readme.txt
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\ea98a5-readme.txt
%HOMEPATH%\favorites\links\ea98a5-readme.txt
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\ea98a5-readme.txt
%HOMEPATH%\ea98a5-readme.txt
%ALLUSERSPROFILE%\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\ea98a5-readme.txt
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\ea98a5-readme.txt
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\1033\ea98a5-readme.txt
%HOMEPATH%\favorites\links for united states\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft\ilscache\ea98a5-readme.txt
%HOMEPATH%\favorites\microsoft websites\ea98a5-readme.txt
%ALLUSERSPROFILE%\microsoft\mf\ea98a5-readme.txt
%HOMEPATH%\favorites\msn websites\ea98a5-readme.txt
%HOMEPATH%\favorites\windows live\ea98a5-readme.txt
%LOCALAPPDATA%\opera software\opera stable\cache\ea98a5-readme.txt
%ProgramFiles(x86)%\steam\graphics\broadcast\ea98a5-readme.txt
%ProgramFiles(x86)%\winamp\skins\bento\xml\ea98a5-readme.txt

Deletes the following files

%TEMP%\res8823.tmp
%TEMP%\csc8813.tmp
%TEMP%\h5s87rwd.dll
%TEMP%\h5s87rwd.0.cs
%TEMP%\h5s87rwd.cmdline
%TEMP%\h5s87rwd.pdb
%TEMP%\h5s87rwd.out
%TEMP%\res8c96.tmp
%TEMP%\csc8c95.tmp
%TEMP%\jo5x_w7p.out
%TEMP%\jo5x_w7p.cmdline
%TEMP%\jo5x_w7p.0.cs
%TEMP%\jo5x_w7p.dll
%TEMP%\jo5x_w7p.pdb

Moves the following files

from %ProgramFiles(x86)%\mirc\readme.txt to %ProgramFiles(x86)%\mirc\readme.txt.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\tr.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\tr.gif.ea98a5
from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\30-non-latin-inf-win.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\30-non-latin-inf-win.conf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00273_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00273_.wmf.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\dv_vjsharp.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\dv_vjsharp.hxi.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\tl.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\tl.gif.ea98a5
from %ProgramFiles(x86)%\steam\bin\locales\ca.pak to %ProgramFiles(x86)%\steam\bin\locales\ca.pak.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00270_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00270_.wmf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\submission_history.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\submission_history.gif.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\curve.gif to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\curve.gif.ea98a5
from %ProgramFiles(x86)%\steam\bin\locales\bn.pak to %ProgramFiles(x86)%\steam\bin\locales\bn.pak.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00269_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00269_.wmf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\stop_collection_data.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\stop_collection_data.gif.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\csspec.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\csspec.hxs.ea98a5
from %ProgramFiles(x86)%\steam\bin\locales\bg.pak to %ProgramFiles(x86)%\steam\bin\locales\bg.pak.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00267_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00267_.wmf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_ok.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_ok.gif.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\csspec.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\csspec.hxi.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_lg.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_lg.gif.ea98a5
from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\21-aliases-wine-win7-inf.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\21-aliases-wine-win7-inf.conf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_issue.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_issue.gif.ea98a5
from %ProgramFiles(x86)%\winamp\skins\bento\scripts\mcvcore.maki to %ProgramFiles(x86)%\winamp\skins\bento\scripts\mcvcore.maki.ea98a5
from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\20-fix-cantarell.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\20-fix-cantarell.conf.ea98a5
from %ProgramFiles(x86)%\steam\bin\snapshot_blob.bin to %ProgramFiles(x86)%\steam\bin\snapshot_blob.bin.ea98a5
from %ProgramFiles(x86)%\steam\graphics\achievementbg_recent.tga to %ProgramFiles(x86)%\steam\graphics\achievementbg_recent.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\avatarborderoffline.tga to %ProgramFiles(x86)%\steam\graphics\avatarborderoffline.tga.ea98a5
from %ProgramFiles(x86)%\steam\bin\debug.log to %ProgramFiles(x86)%\steam\bin\debug.log.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviews_joined.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviews_joined.gif.ea98a5
from %ProgramFiles(x86)%\steam\bin\locales\cs.pak to %ProgramFiles(x86)%\steam\bin\locales\cs.pak.ea98a5
from %ProgramFiles(x86)%\steam\graphics\avatarborderonline.tga to %ProgramFiles(x86)%\steam\graphics\avatarborderonline.tga.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\sdkstart.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\sdkstart.hxs.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnonnotificationintray.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnonnotificationintray.gif.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnonnotificationinacrobat.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnonnotificationinacrobat.gif.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\sdkstart.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\sdkstart.hxi.ea98a5
from %ProgramFiles(x86)%\steam\graphics\broadcast\icon_close_hover.tga to %ProgramFiles(x86)%\steam\graphics\broadcast\icon_close_hover.tga.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnoffnotificationintray.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnoffnotificationintray.gif.ea98a5
from %ProgramFiles(x86)%\steam\graphics\broadcast\icon_close_default.tga to %ProgramFiles(x86)%\steam\graphics\broadcast\icon_close_default.tga.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\netsdknlinks.hxk to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\netsdknlinks.hxk.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnoffnotificationinacrobat.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnoffnotificationinacrobat.gif.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\netsdkklinks.hxk to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\netsdkklinks.hxk.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\netsdkflinks.hxk to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\netsdkflinks.hxk.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\netsdkalinks.hxk to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\netsdkalinks.hxk.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\mwsdk.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\mwsdk.hxs.ea98a5
from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\44-repl-corrective.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\44-repl-corrective.conf.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btndefbottom.tga to %ProgramFiles(x86)%\steam\graphics\btndefbottom.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btndefbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btndefbottomleft.tga.ea98a5
from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\43-repl-tt-traced-bitmap.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\43-repl-tt-traced-bitmap.conf.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\mwsdk.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\mwsdk.hxi.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\mslogo.gif to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\mslogo.gif.ea98a5
from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\42-repl-global.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\42-repl-global.conf.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\jscriptnet.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\jscriptnet.hxs.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\trash.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\trash.gif.ea98a5
from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\41-repl-os-win.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\41-repl-os-win.conf.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\dv_vjsyntax.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\dv_vjsyntax.hxs.ea98a5
from %ProgramFiles(x86)%\steam\graphics\bg_security_wizard.tga to %ProgramFiles(x86)%\steam\graphics\bg_security_wizard.tga.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\dv_vjsharp.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\dv_vjsharp.hxs.ea98a5
from %ProgramFiles(x86)%\steam\graphics\bigpicturebg.tga to %ProgramFiles(x86)%\steam\graphics\bigpicturebg.tga.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\warning.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\warning.gif.ea98a5
from %ProgramFiles(x86)%\steam\bin\mssdsp.flt to %ProgramFiles(x86)%\steam\bin\mssdsp.flt.ea98a5
from %ProgramFiles(x86)%\steam\bin\locales\am.pak to %ProgramFiles(x86)%\steam\bin\locales\am.pak.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptools.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptools.hxs.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\info.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\info.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00152_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00152_.wmf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\form_responses.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\form_responses.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00148_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00148_.wmf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_super.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_super.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00130_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00130_.wmf.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptools.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptools.hxi.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_received.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_received.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00105_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00105_.wmf.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptools.chm to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptools.chm.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_distributed.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_distributed.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00098_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00098_.wmf.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpsamples.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpsamples.hxs.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\end_review.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\end_review.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00045_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00045_.wmf.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpsamples.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpsamples.hxi.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\ended_review_or_form.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\ended_review_or_form.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00012_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00012_.wmf.ea98a5
from %ProgramFiles(x86)%\steam\friends\claneventnotification.res to %ProgramFiles(x86)%\steam\friends\claneventnotification.res.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpref.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpref.hxs.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\email_initiator.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\email_initiator.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00008_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00008_.wmf.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpref.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpref.hxi.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\main.css to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\main.css.ea98a5
from %ProgramFiles(x86)%\steam\bin\devtools_resources.pak to %ProgramFiles(x86)%\steam\bin\devtools_resources.pak.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00194_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00194_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00195_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00195_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00234_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00234_.wmf.ea98a5
from %ProgramFiles(x86)%\steam\bin\natives_blob.bin to %ProgramFiles(x86)%\steam\bin\natives_blob.bin.ea98a5
from %ProgramFiles(x86)%\steam\bin\mssmp3.asi to %ProgramFiles(x86)%\steam\bin\mssmp3.asi.ea98a5
from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\20-aliases-default-win.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\20-aliases-default-win.conf.ea98a5
from %ProgramFiles(x86)%\steam\bin\shaders\d3d10overlay.fxo to %ProgramFiles(x86)%\steam\bin\shaders\d3d10overlay.fxo.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00265_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00265_.wmf.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\csref.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\csref.hxs.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00262_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00262_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00261_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00261_.wmf.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\csref.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\csref.hxi.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00254_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00254_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00252_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00252_.wmf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviewers.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviewers.gif.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cscomp.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cscomp.hxs.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\pdf.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\pdf.gif.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cscomp.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cscomp.hxi.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\open_original_form.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\open_original_form.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00248_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00248_.wmf.ea98a5
from %APPDATA%\mail.ru\agent\mra\fonts\segoesc.ttf to %APPDATA%\mail.ru\agent\mra\fonts\segoesc.ttf.ea98a5
from %APPDATA%\mail.ru\agent\mra\database\citylist_ua.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_ua.csv.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00247_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00247_.wmf.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptutorials.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptutorials.hxs.ea98a5
from %ProgramFiles(x86)%\steam\friends\friendgameinvitedialog.res to %ProgramFiles(x86)%\steam\friends\friendgameinvitedialog.res.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00242_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00242_.wmf.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptutorials.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cptutorials.hxi.ea98a5
from %ProgramFiles(x86)%\steam\bin\mssvoice.asi to %ProgramFiles(x86)%\steam\bin\mssvoice.asi.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\peverify.exe.config to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\peverify.exe.config.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vblr7net.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vblr7net.hxi.ea98a5
from %ProgramFiles(x86)%\winamp\system\alac.w5s to %ProgramFiles(x86)%\winamp\system\alac.w5s.ea98a5
from %ProgramFiles(x86)%\winamp\system\aacdec.w5s to %ProgramFiles(x86)%\winamp\system\aacdec.w5s.ea98a5
from %ProgramFiles(x86)%\steam\graphics\creditcard_back.tga to %ProgramFiles(x86)%\steam\graphics\creditcard_back.tga.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\version.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\version.js.ea98a5
from %ProgramFiles(x86)%\steam\graphics\creditcard_back_amex.tga to %ProgramFiles(x86)%\steam\graphics\creditcard_back_amex.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\chkseldown.tga to %ProgramFiles(x86)%\steam\graphics\chkseldown.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\chkseldown_sm.tga to %ProgramFiles(x86)%\steam\graphics\chkseldown_sm.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\chkselfocus.tga to %ProgramFiles(x86)%\steam\graphics\chkselfocus.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\chkselfocus_sm.tga to %ProgramFiles(x86)%\steam\graphics\chkselfocus_sm.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\chkselstd.tga to %ProgramFiles(x86)%\steam\graphics\chkselstd.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\chkselstd_sm.tga to %ProgramFiles(x86)%\steam\graphics\chkselstd_sm.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\chkunseldis_sm.tga to %ProgramFiles(x86)%\steam\graphics\chkunseldis_sm.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\chkunselfocus.tga to %ProgramFiles(x86)%\steam\graphics\chkunselfocus.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\chkaeldis_sm.tga to %ProgramFiles(x86)%\steam\graphics\chkaeldis_sm.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\chkindeterminate.tga to %ProgramFiles(x86)%\steam\graphics\chkindeterminate.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\chkseldis.tga to %ProgramFiles(x86)%\steam\graphics\chkseldis.tga.ea98a5
from %ProgramFiles(x86)%\steam\friends\voice_hang_up.wav to %ProgramFiles(x86)%\steam\friends\voice_hang_up.wav.ea98a5
from %ProgramFiles(x86)%\winamp\system\adpcm.w5s to %ProgramFiles(x86)%\winamp\system\adpcm.w5s.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnstdtop.tga to %ProgramFiles(x86)%\steam\graphics\btnstdtop.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnstdtopleft.tga to %ProgramFiles(x86)%\steam\graphics\btnstdtopleft.tga.ea98a5
from %ProgramFiles(x86)%\steam\friends\tradeinvitebar.res to %ProgramFiles(x86)%\steam\friends\tradeinvitebar.res.ea98a5
from %ProgramFiles(x86)%\steam\friends\voicebar.res to %ProgramFiles(x86)%\steam\friends\voicebar.res.ea98a5
from %ProgramFiles(x86)%\steam\friends\voicechatinvitenotification.res to %ProgramFiles(x86)%\steam\friends\voicechatinvitenotification.res.ea98a5
from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\fonts.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\fonts.conf.ea98a5
from %ProgramFiles(x86)%\steam\friends\trackerui_norwegian.txt to %ProgramFiles(x86)%\steam\friends\trackerui_norwegian.txt.ea98a5
from %ProgramFiles(x86)%\steam\bin\locales\fa.pak to %ProgramFiles(x86)%\steam\bin\locales\fa.pak.ea98a5
from %ProgramFiles(x86)%\winamp\system\albumart.w5s to %ProgramFiles(x86)%\winamp\system\albumart.w5s.ea98a5
from %ProgramFiles(x86)%\winamp\system\adpcm.wbm to %ProgramFiles(x86)%\winamp\system\adpcm.wbm.ea98a5
from %ProgramFiles(x86)%\steam\graphics\cloud_uhoh.tga to %ProgramFiles(x86)%\steam\graphics\cloud_uhoh.tga.ea98a5
from %ProgramFiles(x86)%\winamp\system\aacdec.wbm to %ProgramFiles(x86)%\winamp\system\aacdec.wbm.ea98a5
from %ProgramFiles(x86)%\steam\graphics\facebooklogo12.tga to %ProgramFiles(x86)%\steam\graphics\facebooklogo12.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\emailreminder_close.tga to %ProgramFiles(x86)%\steam\graphics\emailreminder_close.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\find_icon_down.tga to %ProgramFiles(x86)%\steam\graphics\find_icon_down.tga.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corsym.idl to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corsym.idl.ea98a5
from %ProgramFiles(x86)%\steam\graphics\downloads_bg.tga to %ProgramFiles(x86)%\steam\graphics\downloads_bg.tga.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corsym.h to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corsym.h.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corsvc.idl to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corsvc.idl.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corsvc.h to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corsvc.h.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corpub.idl to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corpub.idl.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corpub.h to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corpub.h.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corprof.idl to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corprof.idl.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corprof.h to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corprof.h.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corhlpr.cpp to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corhlpr.cpp.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btndefright.tga to %ProgramFiles(x86)%\steam\graphics\btndefright.tga.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corhdr.h to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corhdr.h.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corerror.h to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corerror.h.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\cordebug.idl to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\cordebug.idl.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\cordebug.h to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\cordebug.h.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\cor.h to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\cor.h.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\guidebug\msdis140.pdb to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\guidebug\msdis140.pdb.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\guidebug\dbgclr.exe.config to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\guidebug\dbgclr.exe.config.ea98a5
from %ProgramFiles(x86)%\steam\graphics\chkunselfocus_sm.tga to %ProgramFiles(x86)%\steam\graphics\chkunselfocus_sm.tga.ea98a5
from %ProgramFiles(x86)%\winamp\system\alac.wbm to %ProgramFiles(x86)%\winamp\system\alac.wbm.ea98a5
from %ProgramFiles(x86)%\steam\graphics\cloud_localfiles.tga to %ProgramFiles(x86)%\steam\graphics\cloud_localfiles.tga.ea98a5
from %ProgramFiles(x86)%\winamp\system\auth.w5s to %ProgramFiles(x86)%\winamp\system\auth.w5s.ea98a5
from %ProgramFiles(x86)%\steam\graphics\find_icon_down_hover.tga to %ProgramFiles(x86)%\steam\graphics\find_icon_down_hover.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnseltop.tga to %ProgramFiles(x86)%\steam\graphics\btnseltop.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnseltopleft.tga to %ProgramFiles(x86)%\steam\graphics\btnseltopleft.tga.ea98a5
from %ProgramFiles(x86)%\steam\friends\newturnsnotification.res to %ProgramFiles(x86)%\steam\friends\newturnsnotification.res.ea98a5
from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\90-reject.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\90-reject.conf.ea98a5
from %ProgramFiles(x86)%\steam\bin\locales\es-419.pak to %ProgramFiles(x86)%\steam\bin\locales\es-419.pak.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vccore.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vccore.hxi.ea98a5
from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\90-no-synthetic.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\90-no-synthetic.conf.ea98a5
from %ProgramFiles(x86)%\steam\bin\locales\en-us.pak to %ProgramFiles(x86)%\steam\bin\locales\en-us.pak.ea98a5
from %ProgramFiles(x86)%\steam\bin\locales\en-gb.pak to %ProgramFiles(x86)%\steam\bin\locales\en-gb.pak.ea98a5
from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\81-final-rendering-inf-7-xp.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\81-final-rendering-inf-7-xp.conf.ea98a5
from %ProgramFiles(x86)%\steam\bin\locales\el.pak to %ProgramFiles(x86)%\steam\bin\locales\el.pak.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vblsnet.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vblsnet.hxs.ea98a5
from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\60-group-tt-fonts.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\60-group-tt-fonts.conf.ea98a5
from %ProgramFiles(x86)%\steam\bin\locales\de.pak to %ProgramFiles(x86)%\steam\bin\locales\de.pak.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vblsnet.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vblsnet.hxi.ea98a5
from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\60-group-non-tt-fonts.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\60-group-non-tt-fonts.conf.ea98a5
from %ProgramFiles(x86)%\steam\bin\locales\da.pak to %ProgramFiles(x86)%\steam\bin\locales\da.pak.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00274_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00274_.wmf.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btndeftop.tga to %ProgramFiles(x86)%\steam\graphics\btndeftop.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btndeftopleft.tga to %ProgramFiles(x86)%\steam\graphics\btndeftopleft.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btndeftopright.tga to %ProgramFiles(x86)%\steam\graphics\btndeftopright.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btndisbottom.tga to %ProgramFiles(x86)%\steam\graphics\btndisbottom.tga.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vblr7net.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vblr7net.hxs.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\base_uris.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\base_uris.js.ea98a5
from %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\50-base-rendering-win7-winxp.conf to %ProgramFiles(x86)%\steam\bin\panorama\etc\fonts\conf.d\50-base-rendering-win7-winxp.conf.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btndefleft.tga to %ProgramFiles(x86)%\steam\graphics\btndefleft.tga.ea98a5
from %ProgramFiles(x86)%\steam\friends\rampup_2.tga to %ProgramFiles(x86)%\steam\friends\rampup_2.tga.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\init.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\init.js.ea98a5
from %ProgramFiles(x86)%\steam\bin\locales\et.pak to %ProgramFiles(x86)%\steam\bin\locales\et.pak.ea98a5
from %ProgramFiles(x86)%\steam\bin\locales\es.pak to %ProgramFiles(x86)%\steam\bin\locales\es.pak.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\variant.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\variant.js.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnstdbottom.tga to %ProgramFiles(x86)%\steam\graphics\btnstdbottom.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnseltopright.tga to %ProgramFiles(x86)%\steam\graphics\btnseltopright.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnstdbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btnstdbottomleft.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnstdbottomright.tga to %ProgramFiles(x86)%\steam\graphics\btnstdbottomright.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnstdleft.tga to %ProgramFiles(x86)%\steam\graphics\btnstdleft.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnstdright.tga to %ProgramFiles(x86)%\steam\graphics\btnstdright.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnovrontop.tga to %ProgramFiles(x86)%\steam\graphics\btnovrontop.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnselbottom.tga to %ProgramFiles(x86)%\steam\graphics\btnselbottom.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnselbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btnselbottomleft.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnselbottomright.tga to %ProgramFiles(x86)%\steam\graphics\btnselbottomright.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnselleft.tga to %ProgramFiles(x86)%\steam\graphics\btnselleft.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnselright.tga to %ProgramFiles(x86)%\steam\graphics\btnselright.tga.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd20013_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd20013_.wmf.ea98a5
from %ProgramFiles(x86)%\steam\friends\claninvitationnotification.res to %ProgramFiles(x86)%\steam\friends\claninvitationnotification.res.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnovroffright.tga to %ProgramFiles(x86)%\steam\graphics\btnovroffright.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnovrofftopright.tga to %ProgramFiles(x86)%\steam\graphics\btnovrofftopright.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnovronbottom.tga to %ProgramFiles(x86)%\steam\graphics\btnovronbottom.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnovronbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovronbottomleft.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnovronbottomright.tga to %ProgramFiles(x86)%\steam\graphics\btnovronbottomright.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnovronleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovronleft.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnovronright.tga to %ProgramFiles(x86)%\steam\graphics\btnovronright.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnovroffbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovroffbottomleft.tga.ea98a5
from %ProgramFiles(x86)%\winamp\plugins\winampflv.swf to %ProgramFiles(x86)%\winamp\plugins\winampflv.swf.ea98a5
from %ProgramFiles(x86)%\steam\friends\subpanelfindbuddy.res to %ProgramFiles(x86)%\steam\friends\subpanelfindbuddy.res.ea98a5
from %ProgramFiles(x86)%\steam\friends\subpaneluserinfodetails.res to %ProgramFiles(x86)%\steam\friends\subpaneluserinfodetails.res.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vccore.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\vccore.hxs.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnovrofftop.tga to %ProgramFiles(x86)%\steam\graphics\btnovrofftop.tga.ea98a5
from %ProgramFiles(x86)%\steam\graphics\btnovrofftopleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovrofftopleft.tga.ea98a5
from %ProgramFiles(x86)%\steam\controller_base\videoplayer.vdf to %ProgramFiles(x86)%\steam\controller_base\videoplayer.vdf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\distribute_form.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\distribute_form.gif.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpqstart.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpqstart.hxs.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an02724_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an02724_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00173_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00173_.wmf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00160_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00160_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00155_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00155_.wmf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00146_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00146_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00141_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00141_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00116_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00116_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\baby_01.mid to %ProgramFiles%\microsoft office\clipart\pub60cor\baby_01.mid.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04384_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04384_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04369_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04369_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04355_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04355_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04332_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04332_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04326_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04326_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04323_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04323_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04206_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04206_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04196_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04196_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04195_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04195_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04191_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04191_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04174_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04174_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04134_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04134_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04117_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04117_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04108_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04108_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an03500_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an03500_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an02122_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an02122_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd05119_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd05119_.wmf.ea98a5
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd06200_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd06200_.wmf.ea98a5
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome_100_percent.pak to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome_100_percent.pak.ea98a5
from %APPDATA%\adobe\acrobat\dc\jscache\globsettings to %APPDATA%\adobe\acrobat\dc\jscache\globsettings.ea98a5
from %APPDATA%\adobe\acrobat\dc\jscache\globdata to %APPDATA%\adobe\acrobat\dc\jscache\globdata.ea98a5
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\nacl_irt_x86_32.nexe to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\nacl_irt_x86_32.nexe.ea98a5
from %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm to %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm.ea98a5
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\extensions\external_extensions.json to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\extensions\external_extensions.json.ea98a5
from %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt.ea98a5
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\search.crx to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\search.crx.ea98a5
from %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\icarosdescriptions.propdesc to %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\icarosdescriptions.propdesc.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api.ea98a5
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\gmail.crx to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\gmail.crx.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08808_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08808_.wmf.ea98a5
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\external_extensions.json to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\external_extensions.json.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08773_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08773_.wmf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\pmp\adobepdf417.pmp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\pmp\adobepdf417.pmp.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\adobepdf.xdc to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\adobepdf.xdc.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\accessibility.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\accessibility.api.ea98a5
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\drive.crx to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\drive.crx.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08758_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08758_.wmf.ea98a5
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\docs.crx to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\default_apps\docs.crx.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd07831_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd07831_.wmf.ea98a5
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome_200_percent.pak to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome_200_percent.pak.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd07804_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd07804_.wmf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\locale\en_us\stopwords.enu to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\locale\en_us\stopwords.enu.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd07761_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd07761_.wmf.ea98a5
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\natives_blob.bin to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\natives_blob.bin.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an02559_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an02559_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01545_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01545_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00914_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00914_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif.ea98a5
from %ProgramFiles%\firefox\softokn3.chk to %ProgramFiles%\firefox\softokn3.chk.ea98a5
from %ProgramFiles%\firefox\updater.ini to %ProgramFiles%\firefox\updater.ini.ea98a5
from %ProgramFiles%\firefox\readme.txt to %ProgramFiles%\firefox\readme.txt.ea98a5
from %ProgramFiles%\firefox\update.locale to %ProgramFiles%\firefox\update.locale.ea98a5
from %ProgramFiles%\foxit\foxit to %ProgramFiles%\foxit\foxit.ea98a5
from %ProgramFiles%\firefox\application.ini to %ProgramFiles%\firefox\application.ini.ea98a5
from %ProgramFiles(x86)%\steam\libx264-142.dll.md5 to %ProgramFiles(x86)%\steam\libx264-142.dll.md5.ea98a5
from %ProgramFiles(x86)%\steam\libav_h264-56.dll.md5 to %ProgramFiles(x86)%\steam\libav_h264-56.dll.md5.ea98a5
from %ProgramFiles(x86)%\winamp\whatsnew.txt to %ProgramFiles(x86)%\winamp\whatsnew.txt.ea98a5
from %ProgramFiles(x86)%\winamp\paths.ini to %ProgramFiles(x86)%\winamp\paths.ini.ea98a5
from %ProgramFiles(x86)%\winamp\install.ini to %ProgramFiles(x86)%\winamp\install.ini.ea98a5
from %ProgramFiles(x86)%\winamp\pconfig.dcf to %ProgramFiles(x86)%\winamp\pconfig.dcf.ea98a5
from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\unins000.msg.ea98a5
from %ProgramFiles(x86)%\opera\installer_prefs.json to %ProgramFiles(x86)%\opera\installer_prefs.json.ea98a5
from %ProgramFiles(x86)%\opera\resources.pri to %ProgramFiles(x86)%\opera\resources.pri.ea98a5
from %ProgramFiles(x86)%\opera\server_tracking_data to %ProgramFiles(x86)%\opera\server_tracking_data.ea98a5
from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets.ea98a5
from %ProgramFiles(x86)%\mirc\mirc.chm to %ProgramFiles(x86)%\mirc\mirc.chm.ea98a5
from %ProgramFiles(x86)%\mirc\versions.txt to %ProgramFiles(x86)%\mirc\versions.txt.ea98a5
from %ProgramFiles(x86)%\mirc\ircintro.chm to %ProgramFiles(x86)%\mirc\ircintro.chm.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif.ea98a5
from %ProgramFiles%\winrar\default64.sfx to %ProgramFiles%\winrar\default64.sfx.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00092_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00092_.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01251_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01251_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01218_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01218_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01216_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01216_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01184_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01184_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01174_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01174_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01173_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01173_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01084_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01084_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01060_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01060_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01044_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01044_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01039_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01039_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00965_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00965_.wmf.ea98a5
from %ProgramFiles(x86)%\steam\graphics\facebooklogo140.tga to %ProgramFiles(x86)%\steam\graphics\facebooklogo140.tga.ea98a5
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\pepperflash\manifest.json to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\pepperflash\manifest.json.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00853_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00853_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00790_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00790_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00015_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00015_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00010_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00010_.wmf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00176_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00176_.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00175_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00175_.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00161_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00161_.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00160_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00160_.gif.ea98a5
from %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\1033\synchronization.rll to %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\1033\synchronization.rll.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif.ea98a5
from %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets to %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets.ea98a5
from %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets to %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00932_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00932_.wmf.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corhlpr.h to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\corhlpr.h.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08868_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08868_.wmf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ia32.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ia32.api.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09664_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09664_.wmf.ea98a5
from %ProgramFiles(x86)%\steam\controller_base\app_generic.vdf to %ProgramFiles(x86)%\steam\controller_base\app_generic.vdf.ea98a5
from %ProgramFiles(x86)%\winamp\lang\winamp-tr-tr.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-tr-tr.wlz.ea98a5
from %ProgramFiles(x86)%\winamp\lang\winamp-zh-cn.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-zh-cn.wlz.ea98a5
from %ProgramFiles(x86)%\winamp\lang\winamp-zh-tw.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-zh-tw.wlz.ea98a5
from %ProgramFiles(x86)%\winamp\lang\winamp-sv-se.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-sv-se.wlz.ea98a5
from %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt to %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt.ea98a5
from %ProgramFiles(x86)%\steam\libx264-142.dll.crypt to %ProgramFiles(x86)%\steam\libx264-142.dll.crypt.ea98a5
from %ProgramFiles(x86)%\steam\html5app\keybinds.cfg to %ProgramFiles(x86)%\steam\html5app\keybinds.cfg.ea98a5
from %ProgramFiles(x86)%\winamp\lang\winamp-nl-nl.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-nl-nl.wlz.ea98a5
from %ProgramFiles(x86)%\winamp\lang\winamp-pl-pl.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-pl-pl.wlz.ea98a5
from %ProgramFiles(x86)%\winamp\lang\winamp-id-id.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-id-id.wlz.ea98a5
from %ProgramFiles(x86)%\winamp\lang\winamp-es-us.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-es-us.wlz.ea98a5
from %ProgramFiles(x86)%\winamp\components\ssdp.w6c to %ProgramFiles(x86)%\winamp\components\ssdp.w6c.ea98a5
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_125_percent.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\opera_125_percent.pak.ea98a5
from %ProgramFiles(x86)%\opera\29.0.1795.47\snapshot_blob.bin to %ProgramFiles(x86)%\opera\29.0.1795.47\snapshot_blob.bin.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\updater.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\updater.api.ea98a5
from %APPDATA%\mail.ru\agent\mra\database\citylist_tr.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_tr.csv.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19563_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19563_.gif.ea98a5
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\opera.pak.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpgenref.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpgenref.hxi.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\spelling.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\spelling.api.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd10972_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd10972_.gif.ea98a5
from %APPDATA%\mail.ru\agent\mra\database\citylist_ru.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_ru.csv.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd10890_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd10890_.gif.ea98a5
from %ProgramFiles(x86)%\steam\config\config.vdf to %ProgramFiles(x86)%\steam\config\config.vdf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\sendmail.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\sendmail.api.ea98a5
from %ProgramFiles(x86)%\steam\friends\broadcastapprovenotification.res to %ProgramFiles(x86)%\steam\friends\broadcastapprovenotification.res.ea98a5
from %ProgramFiles(x86)%\steam\friends\broadcastrecordererrornotification.res to %ProgramFiles(x86)%\steam\friends\broadcastrecordererrornotification.res.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\add_reviewer.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\add_reviewer.gif.ea98a5
from %ProgramFiles(x86)%\steam\controller_base\templates\wasd.vdf to %ProgramFiles(x86)%\steam\controller_base\templates\wasd.vdf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\create_form.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\create_form.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19986_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19986_.wmf.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpqstart.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpqstart.hxi.ea98a5
from %ProgramFiles(x86)%\steam\controller_base\templates\gamepad_joystick.vdf to %ProgramFiles(x86)%\steam\controller_base\templates\gamepad_joystick.vdf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\br.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\br.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19828_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19828_.wmf.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpguidenf.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpguidenf.hxs.ea98a5
from %ProgramFiles(x86)%\steam\controller_base\templates\gamepad_fps.vdf to %ProgramFiles(x86)%\steam\controller_base\templates\gamepad_fps.vdf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19827_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19827_.wmf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\bl.gif to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\bl.gif.ea98a5
from %ProgramFiles(x86)%\steam\controller_base\templates\gamepad+mouse.vdf to %ProgramFiles(x86)%\steam\controller_base\templates\gamepad+mouse.vdf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19695_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19695_.wmf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\enu\eula.ini to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\enu\eula.ini.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpguidenf.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpguidenf.hxi.ea98a5
from %ProgramFiles(x86)%\steam\controller_base\streamingclient_gyro.vdf to %ProgramFiles(x86)%\steam\controller_base\streamingclient_gyro.vdf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpgenref.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\cpgenref.hxs.ea98a5
from %ProgramFiles(x86)%\steam\controller_base\streamingclient_bigpicture.vdf to %ProgramFiles(x86)%\steam\controller_base\streamingclient_bigpicture.vdf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19582_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19582_.gif.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\weblink.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\weblink.api.ea98a5
from %ProgramFiles(x86)%\steam\friends\chaturlwarningdialog.res to %ProgramFiles(x86)%\steam\friends\chaturlwarningdialog.res.ea98a5
from %ProgramFiles(x86)%\steam\controller_base\streamingclient.vdf to %ProgramFiles(x86)%\steam\controller_base\streamingclient.vdf.ea98a5
from %ProgramFiles(x86)%\steam\html5app\package.json to %ProgramFiles(x86)%\steam\html5app\package.json.ea98a5
from %ProgramFiles(x86)%\steam\friends\addfriendenterdetailssubpanel.res to %ProgramFiles(x86)%\steam\friends\addfriendenterdetailssubpanel.res.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\complus.gif to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\complus.gif.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\search.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\search.api.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\commoner.hxs to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\commoner.hxs.ea98a5
from %APPDATA%\icq-profile\update\languages.aff to %APPDATA%\icq-profile\update\languages.aff.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ebook.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ebook.api.ea98a5
from %APPDATA%\icq-profile\base\opt.dbs to %APPDATA%\icq-profile\base\opt.dbs.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\digsig.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\digsig.api.ea98a5
from %APPDATA%\icq-profile\base\mra.dbs to %APPDATA%\icq-profile\base\mra.dbs.ea98a5
from %APPDATA%\ghisler\wincmd.ini to %APPDATA%\ghisler\wincmd.ini.ea98a5
from %APPDATA%\adobe\logtransport2\logtransport2.cfg to %APPDATA%\adobe\logtransport2\logtransport2.cfg.ea98a5
from %APPDATA%\adobe\acrobat\dc\tmgrpprm.sav to %APPDATA%\adobe\acrobat\dc\tmgrpprm.sav.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\checkers.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\checkers.api.ea98a5
from %APPDATA%\adobe\acrobat\dc\tmdocs.sav to %APPDATA%\adobe\acrobat\dc\tmdocs.sav.ea98a5
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll.ea98a5
from %APPDATA%\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl to %APPDATA%\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl.ea98a5
from %ProgramFiles(x86)%\google\chrome\application\debug.log to %ProgramFiles(x86)%\google\chrome\application\debug.log.ea98a5
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sybase.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sybase.xsl.ea98a5
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sql90.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sql90.xsl.ea98a5
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sql70.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sql70.xsl.ea98a5
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sql2000.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sql2000.xsl.ea98a5
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\msjet.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\msjet.xsl.ea98a5
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\informix.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\informix.xsl.ea98a5
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\snapshot_blob.bin to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\snapshot_blob.bin.ea98a5
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\as90.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\as90.xsl.ea98a5
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\as80.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\as80.xsl.ea98a5
from %ProgramFiles(x86)%\k-lite codec pack\info\faq.css to %ProgramFiles(x86)%\k-lite codec pack\info\faq.css.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annots.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annots.api.ea98a5
from %APPDATA%\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl to %APPDATA%\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\escript.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\escript.api.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\makeaccessible.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\makeaccessible.api.ea98a5
from %APPDATA%\mail.ru\agent\mra\database\citylist_en.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_en.csv.ea98a5
from %APPDATA%\icq-profile\update\ver.txt to %APPDATA%\icq-profile\update\ver.txt.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09662_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09662_.wmf.ea98a5
from %APPDATA%\icq-profile\update\languages.hash to %APPDATA%\icq-profile\update\languages.hash.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\commoner.hxi to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\commoner.hxi.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\1pix.gif to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\1pix.gif.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09194_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09194_.wmf.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\reflow.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\reflow.api.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\wsdl.exe.config to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\wsdl.exe.config.ea98a5
from %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\visualui.ttf to %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\visualui.ttf.ea98a5
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09031_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09031_.wmf.ea98a5
from %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\kiks.yandex.ru\fuid01.sol to %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\kiks.yandex.ru\fuid01.sol.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\readoutloud.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\readoutloud.api.ea98a5
from %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\solutiontemplates\blank.vsdir to %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\solutiontemplates\blank.vsdir.ea98a5
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\resources.pak to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\resources.pak.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ppklite.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ppklite.api.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\soapsuds.exe.config to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\soapsuds.exe.config.ea98a5
from %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\solutiontemplates\blank.sln to %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\solutiontemplates\blank.sln.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pddom.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pddom.api.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\microsoft.visualstudio.ldo to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\microsoft.visualstudio.ldo.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia.api.ea98a5
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\mpp\mcimpp.mpp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\mpp\mcimpp.mpp.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\ildasm.exe.config to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\ildasm.exe.config.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\gacutil.exe.config to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\gacutil.exe.config.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\dasmhlp.cnt to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\dasmhlp.cnt.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\cordbg.exe.config to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\cordbg.exe.config.ea98a5
from %ProgramFiles(x86)%\mirc\defaults\scripts\aliases.ini to %ProgramFiles(x86)%\mirc\defaults\scripts\aliases.ini.ea98a5
from %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets to %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets.ea98a5
from %APPDATA%\adobe\acrobat\dc\security\addressbook.acrodata to %APPDATA%\adobe\acrobat\dc\security\addressbook.acrodata.ea98a5
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\mscoree.idl to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\include\mscoree.idl.ea98a5

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\h5s87rwd.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8823.tmp" "%TEMP%\CSC8813.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\jo5x_w7p.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8C96.tmp" "%TEMP%\CSC8C95.tmp"' (with hidden window)

Executes the following

'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\h5s87rwd.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8823.tmp" "%TEMP%\CSC8813.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\jo5x_w7p.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8C96.tmp" "%TEMP%\CSC8C95.tmp"

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial