Trojan.Encoder.24338

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'zkBujohS' = '"<LS_APPDATA>\Identities\DUBeDkBC.exe"'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\zkBujohS.lnk

Заражает следующие исполняемые файлы:

%CommonProgramFiles%\System\ado\msado25.tlb
%CommonProgramFiles%\System\Ole DB\sqlxmlx.rll
%CommonProgramFiles%\System\ado\msado21.tlb
%CommonProgramFiles%\System\ado\msado20.tlb
%CommonProgramFiles%\System\ado\msado26.tlb
%ProgramFiles%\Windows NT\Accessories\mswrd8.wpc
%ProgramFiles%\Windows NT\Accessories\mswrd6.wpc
%ProgramFiles%\Windows NT\Accessories\write.wpc
%CommonProgramFiles%\System\ado\msado27.tlb
%CommonProgramFiles%\System\Ole DB\sqloledb.rll
%CommonProgramFiles%\Microsoft Shared\TextConv\write32.wpc
C:\Far2\Plugins\arclite\7zS2con.sfx
C:\Far2\Plugins\arclite\7zS2.sfx
C:\Far2\Plugins\arclite\7zSD.sfx
C:\Far2\Plugins\arclite\7zCon.sfx
C:\Far2\Plugins\arclite\7z.sfx
%CommonProgramFiles%\Microsoft Shared\TextConv\html32.cnv
%CommonProgramFiles%\Microsoft Shared\TextConv\mswrd632.wpc
%CommonProgramFiles%\Microsoft Shared\TextConv\mswrd832.cnv
C:\Far2\Plugins\FTP\lib\ftpDirList.fll
C:\Far2\Plugins\FTP\lib\ftpProgress.fll

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

удаляет теневые копии разделов.

Изменения в файловой системе:

Создает следующие файлы:

C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001297.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001296.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001279.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001302.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001269.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001308.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001304.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001300.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001293.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001276.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001294.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001298.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001301.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001299.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001288.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001319.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001309.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001315.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001321.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001324.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001323.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001317.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001316.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001311.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001310.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001307.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001306.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001312.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001314.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001313.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001273.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001261.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001272.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001270.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001266.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001278.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001277.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001275.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001259.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001258.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001264.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001268.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001267.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001281.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001265.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001287.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001271.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001292.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001290.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001289.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001285.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001263.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001280.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001242.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001282.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001284.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001274.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001283.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001366.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001360.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001364.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001367.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001370.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001341.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001361.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001362.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001356.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001357.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001350.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001351.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001353.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001359.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001358.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001368.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001379.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001345.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001382.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001380.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001384.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001375.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001374.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001346.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001371.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001369.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001373.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001333.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001376.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001363.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001354.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001327.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001334.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001332.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001318.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001338.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001331.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001335.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001322.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001295.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001320.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001303.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001326.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001305.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001328.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001325.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001339.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001349.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001348.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001330.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001352.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001340.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001286.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001347.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001336.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001329.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001337.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001343.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001291.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001342.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001344.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001115.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001113.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001114.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001118.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001121.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001119.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001107.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001109.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001083.config
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001108.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001106.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001110.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001104.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001105.rbf
%CommonProgramFiles%\System\ado\msado20.tlb.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001205.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001152.gpd
%CommonProgramFiles%\System\ado\msado21.tlb.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001111.rbf
%CommonProgramFiles%\System\ado\msado25.tlb.new
%CommonProgramFiles%\System\ado\msado26.tlb.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001122.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001120.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001123.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001112.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001116.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001159.gpd
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001093.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001124.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001086.config
C:\Muldrop\dmp_0x284_0x20000
C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0
C:\Muldrop\316dbb4fd95fg271f1191b8404d8bdbe_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0
C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_1
C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_3
C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_4
C:\Muldrop\dmp_0x284_0x10000
C:\Muldrop\alBvkpiS.mol_0
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d9f6c67dd28240b5a5de7fa4b29827e4_23ef5514-3059-436f-a4a7-4cefaab20eb1
%APPDATA%\Microsoft\Protect\CREDHIST
<LS_APPDATA>\Identities\DUBeDkBC.exe
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\316caa4ec95ef271e1191a8404c8acad_23ef5514-3059-436f-a4a7-4cefaab20eb1
C:\Muldrop\316dbb4fd95fg271f1191b8404d8bdbe_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_1
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\7e1a0b27-a423-4426-be4d-39f01f3e9b7d
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001094.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001087.config
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001085.mof
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001096.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001103.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001097.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001095.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001084.config
C:\Muldrop\DUBfDlBC.fyf_0
C:\Muldrop\dmp_0x284_0x30000
C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_2
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\sam.sdf.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
C:\System Volume Information\Chkdsk\Chkdsk20130604131154.log
C:\System Volume Information\tracking.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001239.rbf
<SYSTEM32>\dllcache\msado20.tlb.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001208.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001126.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001209.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001255.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\A0001236.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001256.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001257.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001262.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001260.PNF
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001240.rbf
<SYSTEM32>\dllcache\msado25.tlb.new
<SYSTEM32>\dllcache\msado26.tlb.new
<SYSTEM32>\dllcache\msado21.tlb.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001241.rbf
<SYSTEM32>\dllcache\msado27.tlb.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\change.log.1
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.6
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001117.rbf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.4
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.7
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.3
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.9
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001207.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001204.msi
%CommonProgramFiles%\System\ado\msado27.tlb.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001150.cat
<SYSTEM32>\dllcache\sam.sdf.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.2
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.1
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001206.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\OBJECTS.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.10
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001157.cat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.8
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.5

Присваивает атрибут 'скрытый' для следующих файлов:

%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred!decrfile@tutanota.com.apk
%APPDATA%\Microsoft\Protect\CREDHIST!decrfile@tutanota.com.apk
C:\System Volume Information\tracking.log
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\7e1a0b27-a423-4426-be4d-39f01f3e9b7d!decrfile@tutanota.com.apk
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\7e1a0b27-a423-4426-be4d-39f01f3e9b7d
%HOMEPATH%\Start Menu\Programs\Startup\zkBujohS.lnk
%APPDATA%\Microsoft\Protect\CREDHIST
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred

Удаляет следующие файлы:

%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\316caa4ec95ef271e1191a8404c8acad_23ef5514-3059-436f-a4a7-4cefaab20eb1
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d9f6c67dd28240b5a5de7fa4b29827e4_23ef5514-3059-436f-a4a7-4cefaab20eb1

Перемещает следующие файлы:

C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001259.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001259.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001261.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001261.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001270.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001270.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001275.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001275.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001282.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001282.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001263.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001263.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001256.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001256.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001096.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001096.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001280.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001280.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\RestorePointSize в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\RestorePointSize!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001267.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001267.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001258.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001258.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001264.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001264.PNF!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Accessories\mswrd8.wpc в %ProgramFiles%\Windows NT\Accessories\mswrd8.wpc!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001272.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001272.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001266.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001266.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001268.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001268.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001209.msi в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001209.msi!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001278.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001278.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001298.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001298.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001290.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001290.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001293.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001293.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001288.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001288.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001277.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001277.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001300.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001300.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001279.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001279.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001299.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001299.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001301.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001301.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001287.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001287.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001281.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001281.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001274.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001274.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001284.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001284.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001265.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001265.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001273.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001273.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001294.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001294.PNF!decrfile@tutanota.com.apk
%ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\digreqEx.msi в %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\digreqEx.msi!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001283.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001283.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\domain.txt в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\domain.txt!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\ComDb.Dat в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\ComDb.Dat!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.10 в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.10!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001108.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001108.rbf!decrfile@tutanota.com.apk
%ProgramFiles%\Windows Media Player\Skins\compact.wmz в %ProgramFiles%\Windows Media Player\Skins\compact.wmz!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001103.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001103.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19 в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_MACHINE_SAM в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_MACHINE_SAM!decrfile@tutanota.com.apk
%ProgramFiles%\MSN\MSNCoreFiles\OOBE\market.mar в %ProgramFiles%\MSN\MSNCoreFiles\OOBE\market.mar!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.6 в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.6!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\MAPPING.VER в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\MAPPING.VER!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.8 в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.8!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\$WinMgmt.CFG в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\$WinMgmt.CFG!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\INDEX.MAP в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\INDEX.MAP!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\MAPPING2.MAP в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\MAPPING2.MAP!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\OBJECTS.MAP в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\OBJECTS.MAP!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001157.cat в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001157.cat!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\MAPPING1.MAP в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\Repository\FS\MAPPING1.MAP!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Accessories\mswrd6.wpc в %ProgramFiles%\Windows NT\Accessories\mswrd6.wpc!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001110.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001110.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001255.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001255.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_MACHINE_SECURITY в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_MACHINE_SECURITY!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\drivetable.txt в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\drivetable.txt!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001262.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001262.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\drivetable.txt в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\drivetable.txt!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001260.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001260.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\rp.log в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\rp.log!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001257.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001257.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001239.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001239.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.3 в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.3!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20 в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001111.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001111.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001095.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001095.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001241.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001241.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001240.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001240.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\change.log.1 в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\change.log.1!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003 в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001330.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001330.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001339.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001339.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001335.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001335.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001349.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001349.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001336.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001336.PNF!decrfile@tutanota.com.apk
%ProgramFiles%\MSN\MSNCoreFiles\OOBE\signup.mar в %ProgramFiles%\MSN\MSNCoreFiles\OOBE\signup.mar!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001312.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001312.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001318.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001318.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001352.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001352.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001337.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001337.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001329.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001329.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001321.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001321.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001324.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001324.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001328.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001328.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001338.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001338.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001291.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001291.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001344.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001344.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001326.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001326.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001126.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001126.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001369.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001369.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001373.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001373.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001370.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001370.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001354.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001354.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001346.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001346.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001323.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001323.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001374.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001374.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001366.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001366.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001359.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001359.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001356.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001356.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001350.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001350.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001286.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001286.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001353.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001353.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001351.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001351.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001322.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001322.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001340.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001340.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001358.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001358.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001362.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001362.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001208.msi в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001208.msi!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001306.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001306.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001311.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001311.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001289.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001289.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001314.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001314.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001302.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001302.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001271.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001271.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_.DEFAULT в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_.DEFAULT!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001309.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001309.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.5 в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.5!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001297.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001297.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001296.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001296.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001308.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001308.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001304.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001304.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001269.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001269.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001310.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001310.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001292.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001292.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001307.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001307.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001093.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001093.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001317.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001317.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001325.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001325.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001316.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001316.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001320.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001320.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001305.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001305.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001332.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001332.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001331.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001331.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18 в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001327.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001327.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001285.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001285.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19 в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001315.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001315.PNF!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\table.bmp в %ProgramFiles%\Windows NT\Pinball\table.bmp!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001319.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001319.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20 в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001104.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001104.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001295.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001295.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001303.PNF в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001303.PNF!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\rp.log в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\rp.log!decrfile@tutanota.com.apk
%ProgramFiles%\Movie Maker\Shared\paint.png в %ProgramFiles%\Movie Maker\Shared\paint.png!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND14.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND14.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND111.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND111.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND104.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND104.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml в %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND18.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND18.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\FONT.DAT в %ProgramFiles%\Windows NT\Pinball\FONT.DAT!decrfile@tutanota.com.apk
%ProgramFiles%\Movie Maker\Shared\Sample1.jpg в %ProgramFiles%\Movie Maker\Shared\Sample1.jpg!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND12.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND12.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml в %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND105.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND105.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\MSN\MSNCoreFiles\Install\xfp.xml в %ProgramFiles%\MSN\MSNCoreFiles\Install\xfp.xml!decrfile@tutanota.com.apk
%ProgramFiles%\NetMeeting\Blip.wav в %ProgramFiles%\NetMeeting\Blip.wav!decrfile@tutanota.com.apk
%ProgramFiles%\Movie Maker\Shared\Sample2.jpg в %ProgramFiles%\Movie Maker\Shared\Sample2.jpg!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND108.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND108.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND112.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND112.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets в %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets!decrfile@tutanota.com.apk
%ProgramFiles%\NetMeeting\netmeet.htm в %ProgramFiles%\NetMeeting\netmeet.htm!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND131.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND131.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND29.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND29.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND34.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND34.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND240.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND240.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND26.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND26.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND38.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND38.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND243.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND243.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND136.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND136.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND49.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND49.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND181.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND181.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\PINBALL2.MID в %ProgramFiles%\Windows NT\Pinball\PINBALL2.MID!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND19.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND19.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND13.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND13.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND17.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND17.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND22.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND22.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND21.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND21.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND24.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND24.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND20.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND20.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND16.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND16.WAV!decrfile@tutanota.com.apk
C:\Muldrop\dmp_0x284_0x20000 в C:\Muldrop\dmp_0x284_0x20000!decrfile@tutanota.com.apk
C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_3 в C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_3!decrfile@tutanota.com.apk
C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0 в C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0!decrfile@tutanota.com.apk
C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_4 в C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_4!decrfile@tutanota.com.apk
C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_1 в C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_1!decrfile@tutanota.com.apk
C:\Muldrop\dmp_0x284_0x30000 в C:\Muldrop\dmp_0x284_0x30000!decrfile@tutanota.com.apk
%ProgramFiles%\Messenger\logowin.gif в %ProgramFiles%\Messenger\logowin.gif!decrfile@tutanota.com.apk
C:\Muldrop\dmp_0x284_0x10000 в C:\Muldrop\dmp_0x284_0x10000!decrfile@tutanota.com.apk
C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_2 в C:\Muldrop\e9g6d67ee28240c5b5ef7gb4c29827f4_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_2!decrfile@tutanota.com.apk
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred в %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred!decrfile@tutanota.com.apk
%APPDATA%\Microsoft\Protect\CREDHIST в %APPDATA%\Microsoft\Protect\CREDHIST!decrfile@tutanota.com.apk
%APPDATA%\Microsoft\Media Player\0007F0B7.wpl в %APPDATA%\Microsoft\Media Player\0007F0B7.wpl!decrfile@tutanota.com.apk
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\7e1a0b27-a423-4426-be4d-39f01f3e9b7d в %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\7e1a0b27-a423-4426-be4d-39f01f3e9b7d!decrfile@tutanota.com.apk
%APPDATA%\Microsoft\Address Book\%USERNAME%.wab~ в %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~!decrfile@tutanota.com.apk
C:\Muldrop\alBvkpiS.mol_0 в C:\Muldrop\alBvkpiS.mol_0!decrfile@tutanota.com.apk
C:\Muldrop\316dbb4fd95fg271f1191b8404d8bdbe_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0 в C:\Muldrop\316dbb4fd95fg271f1191b8404d8bdbe_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0!decrfile@tutanota.com.apk
%APPDATA%\Microsoft\Address Book\%USERNAME%.wab в %APPDATA%\Microsoft\Address Book\%USERNAME%.wab!decrfile@tutanota.com.apk
C:\Muldrop\316dbb4fd95fg271f1191b8404d8bdbe_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_1 в C:\Muldrop\316dbb4fd95fg271f1191b8404d8bdbe_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_1!decrfile@tutanota.com.apk
%ProgramFiles%\Movie Maker\Shared\Empty.txt в %ProgramFiles%\Movie Maker\Shared\Empty.txt!decrfile@tutanota.com.apk
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml в %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml!decrfile@tutanota.com.apk
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\Client.xml в %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\Client.xml!decrfile@tutanota.com.apk
%ProgramFiles%\Messenger\newalert.wav в %ProgramFiles%\Messenger\newalert.wav!decrfile@tutanota.com.apk
%ProgramFiles%\Movie Maker\Shared\Filters.xml в %ProgramFiles%\Movie Maker\Shared\Filters.xml!decrfile@tutanota.com.apk
%ProgramFiles%\Windows Media Player\npdrmv2.zip в %ProgramFiles%\Windows Media Player\npdrmv2.zip!decrfile@tutanota.com.apk
%ProgramFiles%\MSN\MSNCoreFiles\Install\cinfo.xml в %ProgramFiles%\MSN\MSNCoreFiles\Install\cinfo.xml!decrfile@tutanota.com.apk
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml в %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml!decrfile@tutanota.com.apk
%ProgramFiles%\Messenger\type.wav в %ProgramFiles%\Messenger\type.wav!decrfile@tutanota.com.apk
C:\Muldrop\DUBfDlBC.fyf_0 в C:\Muldrop\DUBfDlBC.fyf_0!decrfile@tutanota.com.apk
%ProgramFiles%\Messenger\newemail.wav в %ProgramFiles%\Messenger\newemail.wav!decrfile@tutanota.com.apk
%ProgramFiles%\Movie Maker\Shared\Profiles\Blank.txt в %ProgramFiles%\Movie Maker\Shared\Profiles\Blank.txt!decrfile@tutanota.com.apk
%ProgramFiles%\Messenger\lvback.gif в %ProgramFiles%\Messenger\lvback.gif!decrfile@tutanota.com.apk
%ProgramFiles%\Microsoft.NET\RedistList\AssemblyList_4_extended.xml в %ProgramFiles%\Microsoft.NET\RedistList\AssemblyList_4_extended.xml!decrfile@tutanota.com.apk
%ProgramFiles%\Microsoft.NET\RedistList\AssemblyList_4_client.xml в %ProgramFiles%\Microsoft.NET\RedistList\AssemblyList_4_client.xml!decrfile@tutanota.com.apk
%ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets в %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets!decrfile@tutanota.com.apk
%ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets в %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets!decrfile@tutanota.com.apk
%ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets в %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets!decrfile@tutanota.com.apk
%ProgramFiles%\Messenger\online.wav в %ProgramFiles%\Messenger\online.wav!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001119.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001119.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001085.mof в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001085.mof!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001115.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001115.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001118.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001118.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001112.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001112.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001087.config в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001087.config!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001120.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001120.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001086.config в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001086.config!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND54.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND54.WAV!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt!decrfile@tutanota.com.apk
%ProgramFiles%\Movie Maker\Shared\news.png в %ProgramFiles%\Movie Maker\Shared\news.png!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND735.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND735.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND999.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND999.WAV!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001083.config в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001083.config!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND68.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND68.WAV!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001113.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001113.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\tracking.log в C:\System Volume Information\tracking.log!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001114.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001114.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001116.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001116.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001122.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001122.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001105.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001105.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.2 в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.2!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\PINBALL.MID в %ProgramFiles%\Windows NT\Pinball\PINBALL.MID!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.4 в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.4!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\RestorePointSize в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\RestorePointSize!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.9 в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.9!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.7 в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\change.log.7!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001117.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001117.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001152.gpd в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001152.gpd!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND827.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND827.WAV!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001159.gpd в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001159.gpd!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001107.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001107.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001106.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001106.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001150.cat в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001150.cat!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001124.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001124.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001121.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001121.rbf!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001123.rbf в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001123.rbf!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND6.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND6.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND39.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND39.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND58.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND58.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND27.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND27.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND8.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND8.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND30.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND30.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND528.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND528.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND43.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND43.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\NetMeeting\TestSnd.wav в %ProgramFiles%\NetMeeting\TestSnd.wav!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND45.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND45.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND3.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND3.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows Media Player\Skins\Revert.wmz в %ProgramFiles%\Windows Media Player\Skins\Revert.wmz!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND25.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND25.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND4.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND4.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND28.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND28.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND50.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND50.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND5.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND5.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND1.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND1.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND49D.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND49D.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND7.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND7.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND36.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND36.WAV!decrfile@tutanota.com.apk
C:\System Volume Information\Chkdsk\Chkdsk20130604131154.log в C:\System Volume Information\Chkdsk\Chkdsk20130604131154.log!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND9.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND9.WAV!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001084.config в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001084.config!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND57.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND57.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND560.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND560.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND563.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND563.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND713.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND713.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND55.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND55.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows Media Player\npds.zip в %ProgramFiles%\Windows Media Player\npds.zip!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND65.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND65.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND53.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND53.WAV!decrfile@tutanota.com.apk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log в C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log!decrfile@tutanota.com.apk
%ProgramFiles%\Messenger\xpmsgr.chm в %ProgramFiles%\Messenger\xpmsgr.chm!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND42.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND42.WAV!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Accessories\write.wpc в %ProgramFiles%\Windows NT\Accessories\write.wpc!decrfile@tutanota.com.apk
%ProgramFiles%\Windows NT\Pinball\SOUND35.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND35.WAV!decrfile@tutanota.com.apk

Подменяет следующие файлы:

<SYSTEM32>\dllcache\msado26.tlb.new
<SYSTEM32>\dllcache\msado25.tlb.new
<SYSTEM32>\dllcache\msado27.tlb.new
<SYSTEM32>\dllcache\msado21.tlb.new
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d9f6c67dd28240b5a5de7fa4b29827e4_23ef5514-3059-436f-a4a7-4cefaab20eb1
<SYSTEM32>\dllcache\sam.sdf.new
<SYSTEM32>\dllcache\msado20.tlb.new

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней