Trojan.Encoder.24338

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'zkBujohS' = '"<LS_APPDATA>\Identities\DUBeDkBC.exe"'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\zkBujohS.lnk

Infects the following executable files:

%CommonProgramFiles%\System\ado\msado25.tlb
%CommonProgramFiles%\System\Ole DB\sqlxmlx.rll
%CommonProgramFiles%\System\ado\msado21.tlb
%CommonProgramFiles%\System\ado\msado20.tlb
%CommonProgramFiles%\System\ado\msado26.tlb
%ProgramFiles%\Windows NT\Accessories\mswrd8.wpc
%ProgramFiles%\Windows NT\Accessories\mswrd6.wpc
%ProgramFiles%\Windows NT\Accessories\write.wpc
%CommonProgramFiles%\System\ado\msado27.tlb
%CommonProgramFiles%\System\Ole DB\sqloledb.rll
%CommonProgramFiles%\Microsoft Shared\TextConv\write32.wpc
C:\Far2\Plugins\arclite\7zS2con.sfx
C:\Far2\Plugins\arclite\7zS2.sfx
C:\Far2\Plugins\arclite\7zSD.sfx
C:\Far2\Plugins\arclite\7zCon.sfx
C:\Far2\Plugins\arclite\7z.sfx
%CommonProgramFiles%\Microsoft Shared\TextConv\html32.cnv
%CommonProgramFiles%\Microsoft Shared\TextConv\mswrd632.wpc
%CommonProgramFiles%\Microsoft Shared\TextConv\mswrd832.cnv
C:\Far2\Plugins\FTP\lib\ftpDirList.fll
C:\Far2\Plugins\FTP\lib\ftpProgress.fll

Malicious functions:

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Modifies file system:

Creates the following files:

C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001297.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001296.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001279.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001302.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001269.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001308.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001304.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001300.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001293.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001276.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001294.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001298.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001301.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001299.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001288.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001319.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001309.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001315.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001321.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001324.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001323.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001317.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001316.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001311.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001310.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001307.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001306.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001312.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001314.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001313.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001273.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001261.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001272.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001270.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001266.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001278.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001277.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001275.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001259.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001258.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001264.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001268.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001267.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001281.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001265.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001287.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001271.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001292.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001290.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001289.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001285.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001263.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001280.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001242.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001282.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001284.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001274.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001283.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001366.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001360.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001364.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001367.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001370.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001341.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001361.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001362.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001356.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001357.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001350.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001351.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001353.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001359.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001358.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001368.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001379.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001345.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001382.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001380.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001384.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001375.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001374.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001346.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001371.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001369.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001373.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001333.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001376.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001363.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001354.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001327.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001334.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001332.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001318.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001338.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001331.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001335.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001322.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001295.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001320.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001303.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001326.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001305.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001328.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001325.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001339.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001349.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001348.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001330.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001352.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001340.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001286.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001347.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001336.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001329.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001337.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001343.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001291.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001342.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001344.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001115.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001113.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001114.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001118.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001121.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001119.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001107.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001109.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001083.config
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001108.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001106.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001110.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001104.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001105.rbf
%CommonProgramFiles%\System\ado\msado20.tlb.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001205.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001152.gpd
%CommonProgramFiles%\System\ado\msado21.tlb.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001111.rbf
%CommonProgramFiles%\System\ado\msado25.tlb.new
%CommonProgramFiles%\System\ado\msado26.tlb.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001122.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001120.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001123.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001112.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001116.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001159.gpd
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001093.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001124.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001086.config
C:\Muldrop\dmp_0x284_0x20000
C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0
C:\Muldrop\316dbb4fd95fg271f1191b8404d8bdbe_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0
C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_1
C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_3
C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_4
C:\Muldrop\dmp_0x284_0x10000
C:\Muldrop\alBvkpiS.mol_0
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d9f6c67dd28240b5a5de7fa4b29827e4_23ef5514-3059-436f-a4a7-4cefaab20eb1
%APPDATA%\Microsoft\Protect\CREDHIST
<LS_APPDATA>\Identities\DUBeDkBC.exe
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\316caa4ec95ef271e1191a8404c8acad_23ef5514-3059-436f-a4a7-4cefaab20eb1
C:\Muldrop\316dbb4fd95fg271f1191b8404d8bdbe_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_1
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\7e1a0b27-a423-4426-be4d-39f01f3e9b7d
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001094.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001087.config
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001085.mof
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001096.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001103.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001097.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001095.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001084.config
C:\Muldrop\DUBfDlBC.fyf_0
C:\Muldrop\dmp_0x284_0x30000
C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_2
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\sam.sdf.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
C:\System Volume Information\Chkdsk\Chkdsk20130604131154.log
C:\System Volume Information\tracking.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001239.rbf
<SYSTEM32>\dllcache\msado20.tlb.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001208.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001126.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001209.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001255.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\A0001236.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001256.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001257.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001262.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001260.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001240.rbf
<SYSTEM32>\dllcache\msado25.tlb.new
<SYSTEM32>\dllcache\msado26.tlb.new
<SYSTEM32>\dllcache\msado21.tlb.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001241.rbf
<SYSTEM32>\dllcache\msado27.tlb.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\change.log.1
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.6
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001117.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.4
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.7
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.3
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.9
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001207.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001204.msi
%CommonProgramFiles%\System\ado\msado27.tlb.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001150.cat
<SYSTEM32>\dllcache\sam.sdf.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.2
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.1
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001206.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\OBJECTS.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.10
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001157.cat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.8
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.5

Sets the 'hidden' attribute to the following files:

%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred!decrfile@tutanota.com.apk
%APPDATA%\Microsoft\Protect\CREDHIST!decrfile@tutanota.com.apk
C:\System Volume Information\tracking.log
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\7e1a0b27-a423-4426-be4d-39f01f3e9b7d!decrfile@tutanota.com.apk
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\7e1a0b27-a423-4426-be4d-39f01f3e9b7d
%HOMEPATH%\Start Menu\Programs\Startup\zkBujohS.lnk
%APPDATA%\Microsoft\Protect\CREDHIST
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred

Deletes the following files:

%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\316caa4ec95ef271e1191a8404c8acad_23ef5514-3059-436f-a4a7-4cefaab20eb1
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d9f6c67dd28240b5a5de7fa4b29827e4_23ef5514-3059-436f-a4a7-4cefaab20eb1

Moves the following files:

from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001259.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001259.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001261.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001261.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001270.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001270.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001275.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001275.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001282.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001282.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001263.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001263.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001256.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001256.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001096.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001096.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001280.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001280.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\RestorePointSize to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\RestorePointSize!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001267.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001267.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001258.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001258.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001264.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001264.PNF!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Accessories\mswrd8.wpc to %ProgramFiles%\Windows NT\Accessories\mswrd8.wpc!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001272.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001272.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001266.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001266.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001268.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001268.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001209.msi to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001209.msi!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001278.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001278.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001298.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001298.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001290.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001290.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001293.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001293.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001288.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001288.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001277.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001277.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001300.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001300.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001279.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001279.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001299.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001299.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001301.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001301.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001287.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001287.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001281.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001281.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001274.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001274.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001284.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001284.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001265.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001265.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001273.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001273.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001294.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001294.PNF!decrfile@tutanota.com.apk
from %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\digreqEx.msi to %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\digreqEx.msi!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001283.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001283.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\domain.txt to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\domain.txt!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\ComDb.Dat to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\ComDb.Dat!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.10 to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.10!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001108.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001108.rbf!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows Media Player\Skins\compact.wmz to %ProgramFiles%\Windows Media Player\Skins\compact.wmz!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001103.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001103.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19 to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_MACHINE_SAM to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_MACHINE_SAM!decrfile@tutanota.com.apk
from %ProgramFiles%\MSN\MSNCoreFiles\OOBE\market.mar to %ProgramFiles%\MSN\MSNCoreFiles\OOBE\market.mar!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.6 to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.6!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\MAPPING.VER to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\MAPPING.VER!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.8 to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.8!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\$WinMgmt.CFG to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\$WinMgmt.CFG!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\INDEX.MAP to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\INDEX.MAP!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\MAPPING2.MAP to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\MAPPING2.MAP!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\OBJECTS.MAP to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\OBJECTS.MAP!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001157.cat to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001157.cat!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\MAPPING1.MAP to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\MAPPING1.MAP!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Accessories\mswrd6.wpc to %ProgramFiles%\Windows NT\Accessories\mswrd6.wpc!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001110.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001110.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001255.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001255.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_MACHINE_SECURITY to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_MACHINE_SECURITY!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\drivetable.txt to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\drivetable.txt!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001262.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001262.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\drivetable.txt to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\drivetable.txt!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001260.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001260.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\rp.log to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\rp.log!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001257.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001257.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001239.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001239.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.3 to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.3!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20 to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001111.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001111.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001095.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001095.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001241.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001241.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001240.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001240.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\change.log.1 to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\change.log.1!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003 to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001330.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001330.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001339.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001339.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001335.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001335.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001349.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001349.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001336.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001336.PNF!decrfile@tutanota.com.apk
from %ProgramFiles%\MSN\MSNCoreFiles\OOBE\signup.mar to %ProgramFiles%\MSN\MSNCoreFiles\OOBE\signup.mar!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001312.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001312.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001318.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001318.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001352.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001352.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001337.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001337.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001329.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001329.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001321.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001321.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001324.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001324.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001328.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001328.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001338.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001338.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001291.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001291.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001344.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001344.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001326.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001326.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001126.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001126.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001369.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001369.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001373.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001373.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001370.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001370.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001354.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001354.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001346.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001346.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001323.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001323.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001374.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001374.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001366.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001366.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001359.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001359.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001356.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001356.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001350.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001350.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001286.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001286.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001353.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001353.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001351.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001351.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001322.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001322.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001340.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001340.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001358.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001358.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001362.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001362.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001208.msi to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001208.msi!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001306.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001306.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001311.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001311.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001289.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001289.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001314.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001314.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001302.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001302.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001271.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001271.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_.DEFAULT to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_.DEFAULT!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001309.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001309.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.5 to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.5!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001297.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001297.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001296.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001296.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001308.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001308.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001304.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001304.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001269.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001269.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001310.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001310.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001292.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001292.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001307.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001307.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001093.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001093.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001317.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001317.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001325.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001325.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001316.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001316.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001320.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001320.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001305.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001305.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001332.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001332.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001331.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001331.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18 to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001327.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001327.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001285.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001285.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19 to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001315.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001315.PNF!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\table.bmp to %ProgramFiles%\Windows NT\Pinball\table.bmp!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001319.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001319.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20 to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001104.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001104.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001295.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001295.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001303.PNF to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001303.PNF!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\rp.log to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\rp.log!decrfile@tutanota.com.apk
from %ProgramFiles%\Movie Maker\Shared\paint.png to %ProgramFiles%\Movie Maker\Shared\paint.png!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND14.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND14.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND111.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND111.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND104.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND104.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND18.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND18.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\FONT.DAT to %ProgramFiles%\Windows NT\Pinball\FONT.DAT!decrfile@tutanota.com.apk
from %ProgramFiles%\Movie Maker\Shared\Sample1.jpg to %ProgramFiles%\Movie Maker\Shared\Sample1.jpg!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND12.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND12.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND105.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND105.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\MSN\MSNCoreFiles\Install\xfp.xml to %ProgramFiles%\MSN\MSNCoreFiles\Install\xfp.xml!decrfile@tutanota.com.apk
from %ProgramFiles%\NetMeeting\Blip.wav to %ProgramFiles%\NetMeeting\Blip.wav!decrfile@tutanota.com.apk
from %ProgramFiles%\Movie Maker\Shared\Sample2.jpg to %ProgramFiles%\Movie Maker\Shared\Sample2.jpg!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND108.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND108.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND112.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND112.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets to %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets!decrfile@tutanota.com.apk
from %ProgramFiles%\NetMeeting\netmeet.htm to %ProgramFiles%\NetMeeting\netmeet.htm!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND131.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND131.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND29.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND29.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND34.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND34.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND240.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND240.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND26.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND26.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND38.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND38.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND243.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND243.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND136.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND136.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND49.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND49.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND181.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND181.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\PINBALL2.MID to %ProgramFiles%\Windows NT\Pinball\PINBALL2.MID!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND19.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND19.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND13.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND13.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND17.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND17.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND22.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND22.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND21.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND21.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND24.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND24.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND20.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND20.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND16.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND16.WAV!decrfile@tutanota.com.apk
from C:\Muldrop\dmp_0x284_0x20000 to C:\Muldrop\dmp_0x284_0x20000!decrfile@tutanota.com.apk
from C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_3 to C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_3!decrfile@tutanota.com.apk
from C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0 to C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0!decrfile@tutanota.com.apk
from C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_4 to C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_4!decrfile@tutanota.com.apk
from C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_1 to C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_1!decrfile@tutanota.com.apk
from C:\Muldrop\dmp_0x284_0x30000 to C:\Muldrop\dmp_0x284_0x30000!decrfile@tutanota.com.apk
from %ProgramFiles%\Messenger\logowin.gif to %ProgramFiles%\Messenger\logowin.gif!decrfile@tutanota.com.apk
from C:\Muldrop\dmp_0x284_0x10000 to C:\Muldrop\dmp_0x284_0x10000!decrfile@tutanota.com.apk
from C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_2 to C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_2!decrfile@tutanota.com.apk
from %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred to %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred!decrfile@tutanota.com.apk
from %APPDATA%\Microsoft\Protect\CREDHIST to %APPDATA%\Microsoft\Protect\CREDHIST!decrfile@tutanota.com.apk
from %APPDATA%\Microsoft\Media Player\0007F0B7.wpl to %APPDATA%\Microsoft\Media Player\0007F0B7.wpl!decrfile@tutanota.com.apk
from %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\7e1a0b27-a423-4426-be4d-39f01f3e9b7d to %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\7e1a0b27-a423-4426-be4d-39f01f3e9b7d!decrfile@tutanota.com.apk
from %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~ to %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~!decrfile@tutanota.com.apk
from C:\Muldrop\alBvkpiS.mol_0 to C:\Muldrop\alBvkpiS.mol_0!decrfile@tutanota.com.apk
from C:\Muldrop\316dbb4fd95fg271f1191b8404d8bdbe_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0 to C:\Muldrop\316dbb4fd95fg271f1191b8404d8bdbe_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0!decrfile@tutanota.com.apk
from %APPDATA%\Microsoft\Address Book\%USERNAME%.wab to %APPDATA%\Microsoft\Address Book\%USERNAME%.wab!decrfile@tutanota.com.apk
from C:\Muldrop\316dbb4fd95fg271f1191b8404d8bdbe_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_1 to C:\Muldrop\316dbb4fd95fg271f1191b8404d8bdbe_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_1!decrfile@tutanota.com.apk
from %ProgramFiles%\Movie Maker\Shared\Empty.txt to %ProgramFiles%\Movie Maker\Shared\Empty.txt!decrfile@tutanota.com.apk
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml!decrfile@tutanota.com.apk
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\Client.xml to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\Client.xml!decrfile@tutanota.com.apk
from %ProgramFiles%\Messenger\newalert.wav to %ProgramFiles%\Messenger\newalert.wav!decrfile@tutanota.com.apk
from %ProgramFiles%\Movie Maker\Shared\Filters.xml to %ProgramFiles%\Movie Maker\Shared\Filters.xml!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows Media Player\npdrmv2.zip to %ProgramFiles%\Windows Media Player\npdrmv2.zip!decrfile@tutanota.com.apk
from %ProgramFiles%\MSN\MSNCoreFiles\Install\cinfo.xml to %ProgramFiles%\MSN\MSNCoreFiles\Install\cinfo.xml!decrfile@tutanota.com.apk
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml!decrfile@tutanota.com.apk
from %ProgramFiles%\Messenger\type.wav to %ProgramFiles%\Messenger\type.wav!decrfile@tutanota.com.apk
from C:\Muldrop\DUBfDlBC.fyf_0 to C:\Muldrop\DUBfDlBC.fyf_0!decrfile@tutanota.com.apk
from %ProgramFiles%\Messenger\newemail.wav to %ProgramFiles%\Messenger\newemail.wav!decrfile@tutanota.com.apk
from %ProgramFiles%\Movie Maker\Shared\Profiles\Blank.txt to %ProgramFiles%\Movie Maker\Shared\Profiles\Blank.txt!decrfile@tutanota.com.apk
from %ProgramFiles%\Messenger\lvback.gif to %ProgramFiles%\Messenger\lvback.gif!decrfile@tutanota.com.apk
from %ProgramFiles%\Microsoft.NET\RedistList\AssemblyList_4_extended.xml to %ProgramFiles%\Microsoft.NET\RedistList\AssemblyList_4_extended.xml!decrfile@tutanota.com.apk
from %ProgramFiles%\Microsoft.NET\RedistList\AssemblyList_4_client.xml to %ProgramFiles%\Microsoft.NET\RedistList\AssemblyList_4_client.xml!decrfile@tutanota.com.apk
from %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets to %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets!decrfile@tutanota.com.apk
from %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets to %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets!decrfile@tutanota.com.apk
from %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets to %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets!decrfile@tutanota.com.apk
from %ProgramFiles%\Messenger\online.wav to %ProgramFiles%\Messenger\online.wav!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001119.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001119.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001085.mof to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001085.mof!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001115.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001115.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001118.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001118.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001112.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001112.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001087.config to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001087.config!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001120.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001120.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001086.config to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001086.config!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND54.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND54.WAV!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt!decrfile@tutanota.com.apk
from %ProgramFiles%\Movie Maker\Shared\news.png to %ProgramFiles%\Movie Maker\Shared\news.png!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND735.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND735.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND999.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND999.WAV!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001083.config to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001083.config!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND68.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND68.WAV!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001113.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001113.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\tracking.log to C:\System Volume Information\tracking.log!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001114.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001114.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001116.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001116.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001122.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001122.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001105.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001105.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.2 to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.2!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\PINBALL.MID to %ProgramFiles%\Windows NT\Pinball\PINBALL.MID!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.4 to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.4!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\RestorePointSize to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\RestorePointSize!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.9 to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.9!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.7 to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.7!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001117.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001117.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001152.gpd to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001152.gpd!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND827.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND827.WAV!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001159.gpd to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001159.gpd!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001107.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001107.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001106.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001106.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001150.cat to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001150.cat!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001124.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001124.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001121.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001121.rbf!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001123.rbf to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001123.rbf!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND6.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND6.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND39.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND39.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND58.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND58.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND27.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND27.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND8.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND8.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND30.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND30.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND528.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND528.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND43.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND43.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\NetMeeting\TestSnd.wav to %ProgramFiles%\NetMeeting\TestSnd.wav!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND45.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND45.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND3.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND3.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows Media Player\Skins\Revert.wmz to %ProgramFiles%\Windows Media Player\Skins\Revert.wmz!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND25.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND25.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND4.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND4.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND28.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND28.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND50.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND50.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND5.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND5.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND1.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND1.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND49D.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND49D.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND7.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND7.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND36.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND36.WAV!decrfile@tutanota.com.apk
from C:\System Volume Information\Chkdsk\Chkdsk20130604131154.log to C:\System Volume Information\Chkdsk\Chkdsk20130604131154.log!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND9.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND9.WAV!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001084.config to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001084.config!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND57.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND57.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND560.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND560.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND563.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND563.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND713.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND713.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND55.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND55.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows Media Player\npds.zip to %ProgramFiles%\Windows Media Player\npds.zip!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND65.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND65.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND53.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND53.WAV!decrfile@tutanota.com.apk
from C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log to C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log!decrfile@tutanota.com.apk
from %ProgramFiles%\Messenger\xpmsgr.chm to %ProgramFiles%\Messenger\xpmsgr.chm!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND42.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND42.WAV!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Accessories\write.wpc to %ProgramFiles%\Windows NT\Accessories\write.wpc!decrfile@tutanota.com.apk
from %ProgramFiles%\Windows NT\Pinball\SOUND35.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND35.WAV!decrfile@tutanota.com.apk

Substitutes the following files:

<SYSTEM32>\dllcache\msado26.tlb.new
<SYSTEM32>\dllcache\msado25.tlb.new
<SYSTEM32>\dllcache\msado27.tlb.new
<SYSTEM32>\dllcache\msado21.tlb.new
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d9f6c67dd28240b5a5de7fa4b29827e4_23ef5514-3059-436f-a4a7-4cefaab20eb1
<SYSTEM32>\dllcache\sam.sdf.new
<SYSTEM32>\dllcache\msado20.tlb.new

Modifies user data files (Trojan.Encoder).

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial