Trojan.Gozi.1030

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'MicrosoftStartupData' = '"%WINDIR%\MSAudioService.exe" /startup'

Malicious functions

Executes the following

'%WINDIR%\syswow64\net.exe' user SKUNK-kRFyyGM8 nn6nxAbU /add
'%WINDIR%\syswow64\net.exe' user SKUNK-UvqvMK8l bzFsFK2E /add
'%WINDIR%\syswow64\net.exe' user SKUNK-T6GhcNaB goefgQo1 /add
'%WINDIR%\syswow64\net.exe' user SKUNK-pjuMtHA7 bLMfki5I /add
'%WINDIR%\syswow64\net.exe' user SKUNK-NdYQBwCr bPBrafw1 /add
'%WINDIR%\syswow64\net.exe' user SKUNK-j2WxVAaY qskrSZUf /add
'%WINDIR%\syswow64\net.exe' user SKUNK-FltKFeEh H5ynmMBf /add
'%WINDIR%\syswow64\net.exe' user SKUNK-jHGKZQcl 5JKNp9NM /add
'%WINDIR%\syswow64\net.exe' user SKUNK-i6YUTf4J ce0k2KgW /add
'%WINDIR%\syswow64\net.exe' user SKUNK-KAzM0V2i yxi8ArT8 /add
'%WINDIR%\syswow64\net.exe' user SKUNK-XFDEPFre nlU4V4jn /add
'%WINDIR%\syswow64\net.exe' user SKUNK-CZRkSD32 HFIon4i1 /add
'%WINDIR%\syswow64\net.exe' user SKUNK-EvbvpAJz y3F10gjH /add
'%WINDIR%\syswow64\net.exe' user SKUNK-014AVYBj lAFfDGIV /add
'%WINDIR%\syswow64\net.exe' user SKUNK-6YAoNSvy 2BUFI5Vu /add
'%WINDIR%\syswow64\net.exe' user SKUNK-GQ0rWs5Q gONTHoBy /add
'%WINDIR%\syswow64\net.exe' user SKUNK-gaNEhnxG wumCOftU /add
'%WINDIR%\syswow64\net.exe' user SKUNK-51QlEOgc NNxZVvhJ /add
'%WINDIR%\syswow64\net.exe' user SKUNK-5G2Vjume RpGMK0o2 /add
'%WINDIR%\syswow64\net.exe' user SKUNK-k0QlKkKP Ewc5HTWh /add
'%WINDIR%\syswow64\net.exe' user SKUNK-5nnJXFkB v36vgx1T /add
'%WINDIR%\syswow64\net.exe' user SKUNK-oQKkCDEW Fn4z7xG8 /add
'%WINDIR%\syswow64\net.exe' user SKUNK-tMhEz2Lw hgFWpKq2 /add
'%WINDIR%\syswow64\net.exe' user SKUNK-UAW5FhpI 87ogC8PB /add
'%WINDIR%\syswow64\net.exe' user SKUNK-lKiY5AxR uV5sthmO /add
'%WINDIR%\syswow64\net.exe' user SKUNK-e0zSP6Yx ylZaWUWX /add
'%WINDIR%\syswow64\net.exe' user SKUNK-Hv7ORplC rWlJPP5Y /add
'%WINDIR%\syswow64\net.exe' user SKUNK-cGWuKJsI Chllv4gG /add

Terminates or attempts to terminate

the following system processes:

%WINDIR%\syswow64\net.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\000814251_video_01.avi
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%APPDATA%\mozilla\firefox\profiles.ini
%APPDATA%\thunderbird\profiles.ini
%HOMEPATH%\desktop\trivial-merge.html
%HOMEPATH%\desktop\toolbar.bmp
%HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
%HOMEPATH%\desktop\ituneshelpunavailable.html
%HOMEPATH%\desktop\ituneshelpunavailable.htm
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\default.bmp
%LOCALAPPDATA%\google\chrome\user data\default\login data
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\contoso_1.cer
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\adadsi.html
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\dashborder_144.bmp
%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Creates the following files

%WINDIR%\msaudioservice.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\windowsstartupagent.exe
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cache2\entries\4dcacdd154d23ce903bf34716afe0fbdc08801f3

Moves the following files

from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\nb.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\nb.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ms.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ms.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\mk.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\mk.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\me.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\me.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\lv.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\lv.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\lt.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\lt.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ko.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ko.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\kk.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\kk.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ja.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ja.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\it.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\it.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\id.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\id.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\hu.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\hu.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\hr.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\hr.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\hi.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\hi.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\gd.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\gd.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fy.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fy.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fr.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fr.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fil.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fil.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fr-ca.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fr-ca.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\nl.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\nl.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\nn.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\nn.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zh-tw.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zh-tw.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zh-cn.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zh-cn.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\vi.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\vi.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\uk.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\uk.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\tr.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\tr.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\th.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\th.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\te.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\te.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ta.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ta.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sv.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sv.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\es.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\es.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sr.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sr.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sk.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sk.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ru.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ru.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ro.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ro.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pt-pt.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pt-pt.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pt-br.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pt-br.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pl.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pl.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pa.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pa.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fi.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fi.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\es-419.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\es-419.skunk
from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\cfd4be41-4c6d-496a-addb-4095dfa1dd0e.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\cfd4be41-4c6d-496a-addb-4095dfa1dd0e.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\c665d993-1b49-4c2e-962c-beb19993bb86.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\c665d993-1b49-4c2e-962c-beb19993bb86.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\b478fe0c-0761-41c3-946f-cd1340356039.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\b478fe0c-0761-41c3-946f-cd1340356039.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\ad2fd2bd-0727-4af7-8917-aaed8627ed47.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\ad2fd2bd-0727-4af7-8917-aaed8627ed47.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\8d754f20-8bf5-11e2-9e96-0800200c9a66.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\8d754f20-8bf5-11e2-9e96-0800200c9a66.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\76c397a8-9e8e-4706-8203-bd2878e9c618.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\76c397a8-9e8e-4706-8203-bd2878e9c618.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\6d3582e1-6013-429f-bb34-c75b90cdd1f8.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\6d3582e1-6013-429f-bb34-c75b90cdd1f8.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\66dd4bb6-a3ba-4b11-af7a-f4bf23e073b2.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\66dd4bb6-a3ba-4b11-af7a-f4bf23e073b2.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\5bbbdd5b-edc7-4168-9f5d-290af826e716.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\5bbbdd5b-edc7-4168-9f5d-290af826e716.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\4c95adc1-5fd9-449d-bc75-77ca217403ae.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\4c95adc1-5fd9-449d-bc75-77ca217403ae.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\3bfdfa54-5dd6-4dff-8b6c-c1715f306d6b.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\3bfdfa54-5dd6-4dff-8b6c-c1715f306d6b.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\3b6191a0-8bf3-11e2-9e96-0800200c9a66.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\3b6191a0-8bf3-11e2-9e96-0800200c9a66.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\2f8f0e41-f521-45a4-9691-f664afafe67f.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\2f8f0e41-f521-45a4-9691-f664afafe67f.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\2a3f5c20-8bf5-11e2-9e96-0800200c9a66.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\2a3f5c20-8bf5-11e2-9e96-0800200c9a66.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\1cf37043-6733-479c-9086-7b21a2292dda.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\1cf37043-6733-479c-9086-7b21a2292dda.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\1af2cdd0-8bf3-11e2-9e96-0800200c9a66.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\1af2cdd0-8bf3-11e2-9e96-0800200c9a66.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\0cd5f3a0-8bf6-11e2-9e96-0800200c9a66.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\0cd5f3a0-8bf6-11e2-9e96-0800200c9a66.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\default_partner_content.json to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\default_partner_content.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\dictionaries.xml to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\dictionaries.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\en-us.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\en-us.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\be.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\be.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\bg.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\bg.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\en-gb.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\en-gb.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\el.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\el.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\de.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\de.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\da.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\da.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\cs.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\cs.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ca.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ca.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\bn.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\bn.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sw.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sw.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zu.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zu.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\ccced631-6da2-4060-9824-95737e64350c.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\ccced631-6da2-4060-9824-95737e64350c.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\af.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\af.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\license.txt to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\license.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\fff3f819-b6ce-4de6-b4e4-8e2618abc0d9.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\fff3f819-b6ce-4de6-b4e4-8e2618abc0d9.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\ff57f01a-0718-44b7-8a1f-8b15bc33a50b.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\ff57f01a-0718-44b7-8a1f-8b15bc33a50b.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\fdc2ccab-e8f9-4620-91dd-b0b67285997c.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\fdc2ccab-e8f9-4620-91dd-b0b67285997c.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\f98d4d4c-8aa7-4619-a1e7-ac89b24558dd.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\f98d4d4c-8aa7-4619-a1e7-ac89b24558dd.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\f3f34cbb-24ff-4830-9e87-1663e7a0a5ee.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\f3f34cbb-24ff-4830-9e87-1663e7a0a5ee.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\az.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\az.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_schinese.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_schinese.skunk
from %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets to %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.skunk
from %ProgramFiles(x86)%\microsoft office\office14\nameext.dll to %ProgramFiles(x86)%\microsoft office\office14\nameext.skunk
from %ProgramFiles(x86)%\microsoft office\office14\namecontrolproxy.dll to %ProgramFiles(x86)%\microsoft office\office14\namecontrolproxy.skunk
from %ProgramFiles(x86)%\microsoft office\office14\name.dll to %ProgramFiles(x86)%\microsoft office\office14\name.skunk
from %ProgramFiles(x86)%\microsoft office\office14\msohtmed.exe to %ProgramFiles(x86)%\microsoft office\office14\msohtmed.skunk
from %ProgramFiles(x86)%\microsoft office\office14\inlaunch.dll to %ProgramFiles(x86)%\microsoft office\office14\inlaunch.skunk
from %ProgramFiles(x86)%\microsoft office\office14\ieawsdc.dll to %ProgramFiles(x86)%\microsoft office\office14\ieawsdc.skunk
from %ProgramFiles(x86)%\microsoft office\office14\authzax.dll to %ProgramFiles(x86)%\microsoft office\office14\authzax.skunk
from %ProgramFiles(x86)%\microsoft office\office14\bcslaunch.dll to %ProgramFiles(x86)%\microsoft office\office14\bcslaunch.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\privateassemblies\microsoft.visualstudio.tools.applications.project.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\privateassemblies\microsoft.visualstudio.tools.applications.project.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\system.addin.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\system.addin.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.designtime.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.designtime.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.comrpcchannel.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.comrpcchannel.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.addinmanager.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.addinmanager.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.adapter.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.adapter.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\xmlfile.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\xmlfile.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\visualizer.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\visualizer.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\settings.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\settings.skunk
from %ProgramFiles(x86)%\microsoft office\office14\npspwrap.dll to %ProgramFiles(x86)%\microsoft office\office14\npspwrap.skunk
from %ProgramFiles(x86)%\microsoft office\office14\oisctrl.dll to %ProgramFiles(x86)%\microsoft office\office14\oisctrl.skunk
from %ProgramFiles(x86)%\microsoft office\office14\npauthz.dll to %ProgramFiles(x86)%\microsoft office\office14\npauthz.skunk
from %ProgramFiles(x86)%\microsoft office\office14\onbttnie.dll to %ProgramFiles(x86)%\microsoft office\office14\onbttnie.skunk
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msolap100.dll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msolap100.skunk
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmgdsrv.dll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmgdsrv.skunk
from %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm to %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.skunk
from %ProgramFiles(x86)%\microsoft office\office14\1033\vviewres.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\vviewres.skunk
from %ProgramFiles(x86)%\microsoft office\office14\1033\stsupld.intl.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\stsupld.intl.skunk
from %ProgramFiles(x86)%\microsoft office\office14\1033\stsucres.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\stsucres.skunk
from %ProgramFiles(x86)%\microsoft office\office14\1033\ocltint.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\ocltint.skunk
from %ProgramFiles(x86)%\microsoft office\office14\1033\mapishellr.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\mapishellr.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\usercontrol.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\usercontrol.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\07593226-c5c5-438b-86be-3f6361cd5b10.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\07593226-c5c5-438b-86be-3f6361cd5b10.skunk
from %ProgramFiles(x86)%\microsoft office\office14\vviewer.dll to %ProgramFiles(x86)%\microsoft office\office14\vviewer.skunk
from %ProgramFiles(x86)%\microsoft office\office14\stscopy.dll to %ProgramFiles(x86)%\microsoft office\office14\stscopy.skunk
from %ProgramFiles(x86)%\microsoft office\office14\stsupld.dll to %ProgramFiles(x86)%\microsoft office\office14\stsupld.skunk
from %ProgramFiles(x86)%\microsoft office\office14\ppslax.dll to %ProgramFiles(x86)%\microsoft office\office14\ppslax.skunk
from %ProgramFiles(x86)%\microsoft office\office14\onenotesyncpc.dll to %ProgramFiles(x86)%\microsoft office\office14\onenotesyncpc.skunk
from %ProgramFiles(x86)%\microsoft office\office14\owssupp.dll to %ProgramFiles(x86)%\microsoft office\office14\owssupp.skunk
from %ProgramFiles(x86)%\microsoft office\office14\onlntcomlib.dll to %ProgramFiles(x86)%\microsoft office\office14\onlntcomlib.skunk
from %ProgramFiles(x86)%\microsoft office\office14\onbttnielinkednotes.dll to %ProgramFiles(x86)%\microsoft office\office14\onbttnielinkednotes.skunk
from %ProgramFiles(x86)%\microsoft office\office14\vviewdwg.dll to %ProgramFiles(x86)%\microsoft office\office14\vviewdwg.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\textfile.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\textfile.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\cfce84e5-9a95-4b3f-b8e4-3e98cf7ee6c5.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\cfce84e5-9a95-4b3f-b8e4-3e98cf7ee6c5.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\resource.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\resource.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\assemblyinfointernal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\assemblyinfointernal.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\emptydatabase.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\emptydatabase.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\dataset.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\dataset.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\class.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\class.skunk
from %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\microsoft.mshtml.dll to %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\microsoft.mshtml.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\assemblyinfointernal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\assemblyinfointernal.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\appconfigurationinternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\appconfigurationinternal.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaprojectui.dll to %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaprojectui.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaclientpkgui.dll to %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaclientpkgui.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\vstaproject.dll to %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\vstaproject.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\vstaclientpkg.dll to %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\vstaclientpkg.skunk
from %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\stdole.dll to %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\stdole.skunk
from %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\msdatasrc.dll to %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\msdatasrc.skunk
from %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\microsoft.stdformat.dll to %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\microsoft.stdformat.skunk
from %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\adodb.dll to %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\adodb.skunk
from %ProgramFiles(x86)%\microsoft.net\redistlist\assemblylist_4_extended.xml to %ProgramFiles(x86)%\microsoft.net\redistlist\assemblylist_4_extended.skunk
from %ProgramFiles(x86)%\microsoft.net\redistlist\assemblylist_4_client.xml to %ProgramFiles(x86)%\microsoft.net\redistlist\assemblylist_4_client.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\explorer.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\explorer.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\form.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\form.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\loginform.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\loginform.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\mdiparent.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\mdiparent.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\resourceinternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\resourceinternal.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\mdiparent.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\mdiparent.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\interface.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\interface.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\emptydatabase.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\emptydatabase.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\dataset.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\dataset.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\codefile.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\codefile.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\assemblyinfo.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\assemblyinfo.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\class.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\class.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\settingsinternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\settingsinternal.skunk
from %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets to %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\appconfiginternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\appconfiginternal.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\aboutbox.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\aboutbox.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\usercontrol.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\usercontrol.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\splashscreen.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\splashscreen.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\text.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\text.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\resourceinternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\resourceinternal.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\settingsinternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\settingsinternal.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\module.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\module.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\appconfig.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\appconfig.skunk
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\dialog.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\dialog.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\013e742b-287b-4228-a0b9-bd617e4e02a4.ico to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\013e742b-287b-4228-a0b9-bd617e4e02a4.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\wow_helper.exe to %ProgramFiles(x86)%\opera\29.0.1795.47\wow_helper.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\win8_importing.dll to %ProgramFiles(x86)%\opera\29.0.1795.47\win8_importing.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pluginreg.dat to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pluginreg.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\formhistory.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\formhistory.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.skunk
from %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js to %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.skunk
from %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\times.json to %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\times.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\previous.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\previous.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.baklz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\e02cbed0-86f0-4963-b66a-5d4a2cc83071 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\e02cbed0-86f0-4963-b66a-5d4a2cc83071.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\98eb6582-9918-4d79-9779-3f25cee729b9 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\98eb6582-9918-4d79-9779-3f25cee729b9.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\71d39899-113e-4a90-b1d6-a0ddeee2b177 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\71d39899-113e-4a90-b1d6-a0ddeee2b177.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\5ef45117-f126-4176-8609-edb7f996f858 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\5ef45117-f126-4176-8609-edb7f996f858.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\upgrade.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.skunk
from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sku...
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msolui100.dll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msolui100.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117223.e02cbed0-86f0-4963-b66a-5d4a2cc83071.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117223.e02cbed0-86f0-4963-b66a-5d4a2cc83071.event.skunk
from %APPDATA%\telegram desktop\unins000.dat to %APPDATA%\telegram desktop\unins000.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\key4.db to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\key4.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cert9.db to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cert9.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.skunk
from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\mailviews.dat to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\mailviews.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.skunk
from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.skunk
from %APPDATA%\thunderbird\profiles\dm02c46v.default\times.json to %APPDATA%\thunderbird\profiles\dm02c46v.default\times.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.skunk
from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\installs.skunk
from %APPDATA%\telegram desktop\updater.exe to %APPDATA%\telegram desktop\updater.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.skunk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.skunk
from %ProgramFiles(x86)%\microsoft office\office14\1033\bhointl.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\bhointl.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117244.98eb6582-9918-4d79-9779-3f25cee729b9.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117244.98eb6582-9918-4d79-9779-3f25cee729b9.main.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\bookmarks-2025-02-03_11_de2a2eo29nunltkagq5ija==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\bookmarks-2025-02-03_11_de2a2eo29nunltkagq5ija==.skunk
from %ProgramFiles(x86)%\opera\assets\70x70logo.scale-80.png to %ProgramFiles(x86)%\opera\assets\70x70logo.scale-80.skunk
from %ProgramFiles(x86)%\opera\assets\70x70logo.scale-180.png to %ProgramFiles(x86)%\opera\assets\70x70logo.scale-180.skunk
from %ProgramFiles(x86)%\opera\assets\70x70logo.scale-180_contrast-white.png to %ProgramFiles(x86)%\opera\assets\70x70logo.scale-180_contrast-white.skunk
from %ProgramFiles(x86)%\opera\assets\70x70logo.scale-140_contrast-white.png to %ProgramFiles(x86)%\opera\assets\70x70logo.scale-140_contrast-white.skunk
from %ProgramFiles(x86)%\opera\assets\70x70logo.scale-140.png to %ProgramFiles(x86)%\opera\assets\70x70logo.scale-140.skunk
from %ProgramFiles(x86)%\opera\assets\70x70logo.scale-100_contrast-white.png to %ProgramFiles(x86)%\opera\assets\70x70logo.scale-100_contrast-white.skunk
from %ProgramFiles(x86)%\opera\assets\70x70logo.scale-100.png to %ProgramFiles(x86)%\opera\assets\70x70logo.scale-100.skunk
from %ProgramFiles(x86)%\opera\assets\150x150logo.scale-80_contrast-white.png to %ProgramFiles(x86)%\opera\assets\150x150logo.scale-80_contrast-white.skunk
from %ProgramFiles(x86)%\opera\assets\150x150logo.scale-140_contrast-white.png to %ProgramFiles(x86)%\opera\assets\150x150logo.scale-140_contrast-white.skunk
from %ProgramFiles(x86)%\opera\assets\150x150logo.scale-80.png to %ProgramFiles(x86)%\opera\assets\150x150logo.scale-80.skunk
from %ProgramFiles(x86)%\opera\assets\150x150logo.scale-180_contrast-white.png to %ProgramFiles(x86)%\opera\assets\150x150logo.scale-180_contrast-white.skunk
from %ProgramFiles(x86)%\opera\assets\150x150logo.scale-180.png to %ProgramFiles(x86)%\opera\assets\150x150logo.scale-180.skunk
from %ProgramFiles(x86)%\opera\assets\150x150logo.scale-100.png to %ProgramFiles(x86)%\opera\assets\150x150logo.scale-100.skunk
from %ProgramFiles(x86)%\opera\assets\150x150logo.scale-140.png to %ProgramFiles(x86)%\opera\assets\150x150logo.scale-140.skunk
from %ProgramFiles(x86)%\opera\assets\150x150logo.scale-100_contrast-white.png to %ProgramFiles(x86)%\opera\assets\150x150logo.scale-100_contrast-white.skunk
from %ProgramFiles(x86)%\opera\resources.pri to %ProgramFiles(x86)%\opera\resources.skunk
from %ProgramFiles(x86)%\opera\launcher.exe to %ProgramFiles(x86)%\opera\launcher.skunk
from %ProgramFiles(x86)%\opera\assets\70x70logo.scale-80_contrast-white.png to %ProgramFiles(x86)%\opera\assets\70x70logo.scale-80_contrast-white.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\ffmpegsumo.dll to %ProgramFiles(x86)%\opera\29.0.1795.47\ffmpegsumo.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\d3dcompiler_47.dll to %ProgramFiles(x86)%\opera\29.0.1795.47\d3dcompiler_47.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\installer.exe to %ProgramFiles(x86)%\opera\29.0.1795.47\installer.skunk
from %ProgramFiles(x86)%\reference assemblies\microsoft\framework\v3.0\redistlist\frameworklist.xml to %ProgramFiles(x86)%\reference assemblies\microsoft\framework\v3.0\redistlist\frameworklist.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\snapshot_blob.bin to %ProgramFiles(x86)%\opera\29.0.1795.47\snapshot_blob.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\osmesa.dll to %ProgramFiles(x86)%\opera\29.0.1795.47\osmesa.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe to %ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_autoupdate.exe to %ProgramFiles(x86)%\opera\29.0.1795.47\opera_autoupdate.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_250_percent.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\opera_250_percent.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_200_percent.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\opera_200_percent.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_150_percent.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\opera_150_percent.skunk
from %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml to %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_125_percent.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\opera_125_percent.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117246.5ef45117-f126-4176-8609-edb7f996f858.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117246.5ef45117-f126-4176-8609-edb7f996f858.first-shutdown.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\natives_blob.bin to %ProgramFiles(x86)%\opera\29.0.1795.47\natives_blob.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\icudtl.dat to %ProgramFiles(x86)%\opera\29.0.1795.47\icudtl.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\msvcr100.dll to %ProgramFiles(x86)%\opera\29.0.1795.47\msvcr100.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\msvcp100.dll to %ProgramFiles(x86)%\opera\29.0.1795.47\msvcp100.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\message_center_win8.dll to %ProgramFiles(x86)%\opera\29.0.1795.47\message_center_win8.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\libglesv2.dll to %ProgramFiles(x86)%\opera\29.0.1795.47\libglesv2.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\libegl.dll to %ProgramFiles(x86)%\opera\29.0.1795.47\libegl.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_100_percent.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\opera_100_percent.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\store.json.skunk
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\opera.skunk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_greek.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_greek.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_finnish.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_finnish.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_german.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_german.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_french.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_french.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_english.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_english.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_dutch.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_dutch.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_bulgarian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_bulgarian.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_danish.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_danish.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_czech.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_czech.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_brazilian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_brazilian.skunk
from %ProgramFiles(x86)%\steam\uninstall.exe to %ProgramFiles(x86)%\steam\uninstall.skunk
from %ProgramFiles(x86)%\steam\steam.cfg to %ProgramFiles(x86)%\steam\steam.skunk
from %ProgramFiles(x86)%\windows sidebar\settings.ini to %ProgramFiles(x86)%\windows sidebar\settings.skunk
from %LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cache2\entries\4dcacdd154d23ce903bf34716afe0fbdc08801f3 to %LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cache2\entries\4dcacdd154d23ce903bf34716afe0fbdc08801f3.skunk
from %TEMP%\wallpaper.bmp to %TEMP%\wallpaper.skunk
from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\telegram.skunk
from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_hungarian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_hungarian.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_italian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_italian.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_korean.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_korean.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_koreana.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_koreana.skunk
from %ProgramFiles(x86)%\opera\installation_status.xml to %ProgramFiles(x86)%\opera\installation_status.skunk
from %ProgramFiles(x86)%\steam\bin\steamservice.exe to %ProgramFiles(x86)%\steam\bin\steamservice.skunk
from %ProgramFiles(x86)%\steam\logs\bootstrap_log.txt to %ProgramFiles(x86)%\steam\logs\bootstrap_log.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_vietnamese.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_vietnamese.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_turkish.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_turkish.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_ukrainian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_ukrainian.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_tchinese.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_tchinese.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_thai.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_thai.skunk
from %ProgramFiles(x86)%\opera\installer_prefs.json to %ProgramFiles(x86)%\opera\installer_prefs.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_spanish.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_spanish.skunk
from %ProgramFiles(x86)%\reference assemblies\microsoft\framework\v3.0\winfxlist.xml to %ProgramFiles(x86)%\reference assemblies\microsoft\framework\v3.0\winfxlist.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_russian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_russian.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_romanian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_romanian.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_portuguese.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_portuguese.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_polish.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_polish.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_norwegian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_norwegian.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_latam.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_latam.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_japanese.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_japanese.skunk
from %ProgramFiles(x86)%\steam\public\steambootstrapper_swedish.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_swedish.skunk
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.skunk

Modifies the following files

%HOMEPATH%\links\downloads.lnk
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\desktop\adadsi.html
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\favorites\links\web slice gallery.url
%HOMEPATH%\favorites\links for united states\usa.gov.url
%HOMEPATH%\favorites\links for united states\gobiernousa.gov.url
%HOMEPATH%\favorites\microsoft websites\microsoft store.url
%HOMEPATH%\favorites\microsoft websites\ie add-on site.url
%HOMEPATH%\favorites\microsoft websites\microsoft at work.url
%HOMEPATH%\favorites\microsoft websites\microsoft at home.url
%HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url
%HOMEPATH%\favorites\msn websites\msnbc news.url
%HOMEPATH%\favorites\msn websites\msn.url
%HOMEPATH%\favorites\msn websites\msn money.url
%HOMEPATH%\favorites\msn websites\msn sports.url
%HOMEPATH%\favorites\msn websites\msn entertainment.url
%HOMEPATH%\favorites\msn websites\msn autos.url
%HOMEPATH%\favorites\windows live\windows live spaces.url
%HOMEPATH%\favorites\windows live\windows live mail.url
%HOMEPATH%\favorites\windows live\windows live gallery.url
%HOMEPATH%\links\desktop.lnk
%HOMEPATH%\favorites\windows live\get windows live.url
%HOMEPATH%\links\recentplaces.lnk
%HOMEPATH%\desktop\google chrome.lnk
%HOMEPATH%\desktop\ituneshelpunavailable.html

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Network activity

TCP

Other

'34.##9.100.209':443

Miscellaneous

Executes the following

'%WINDIR%\syswow64\net1.exe' user SKUNK-014AVYBj lAFfDGIV /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-NdYQBwCr bPBrafw1 /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-j2WxVAaY qskrSZUf /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-FltKFeEh H5ynmMBf /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-jHGKZQcl 5JKNp9NM /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-i6YUTf4J ce0k2KgW /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-CZRkSD32 HFIon4i1 /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-XFDEPFre nlU4V4jn /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-EvbvpAJz y3F10gjH /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-6YAoNSvy 2BUFI5Vu /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-GQ0rWs5Q gONTHoBy /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-T6GhcNaB goefgQo1 /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-pjuMtHA7 bLMfki5I /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-k0QlKkKP Ewc5HTWh /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-KAzM0V2i yxi8ArT8 /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-Hv7ORplC rWlJPP5Y /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-UvqvMK8l bzFsFK2E /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-tMhEz2Lw hgFWpKq2 /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-5nnJXFkB v36vgx1T /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-oQKkCDEW Fn4z7xG8 /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-lKiY5AxR uV5sthmO /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-UAW5FhpI 87ogC8PB /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-kRFyyGM8 nn6nxAbU /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-5G2Vjume RpGMK0o2 /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-cGWuKJsI Chllv4gG /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-51QlEOgc NNxZVvhJ /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-gaNEhnxG wumCOftU /add
'%WINDIR%\syswow64\net1.exe' user SKUNK-e0zSP6Yx ylZaWUWX /add
'%WINDIR%\syswow64\net.exe' user SKUNK-lKiY5AxR uV5sthmO /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-UAW5FhpI 87ogC8PB /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-NdYQBwCr bPBrafw1 /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-GQ0rWs5Q gONTHoBy /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-T6GhcNaB goefgQo1 /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-FltKFeEh H5ynmMBf /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-UvqvMK8l bzFsFK2E /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-e0zSP6Yx ylZaWUWX /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-Hv7ORplC rWlJPP5Y /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-gaNEhnxG wumCOftU /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-j2WxVAaY qskrSZUf /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-5G2Vjume RpGMK0o2 /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-pjuMtHA7 bLMfki5I /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-5nnJXFkB v36vgx1T /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-6YAoNSvy 2BUFI5Vu /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-tMhEz2Lw hgFWpKq2 /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-k0QlKkKP Ewc5HTWh /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-CZRkSD32 HFIon4i1 /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-XFDEPFre nlU4V4jn /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-EvbvpAJz y3F10gjH /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-KAzM0V2i yxi8ArT8 /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-i6YUTf4J ce0k2KgW /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-51QlEOgc NNxZVvhJ /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-jHGKZQcl 5JKNp9NM /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-oQKkCDEW Fn4z7xG8 /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-014AVYBj lAFfDGIV /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-cGWuKJsI Chllv4gG /add' (with hidden window)
'%WINDIR%\syswow64\net.exe' user SKUNK-kRFyyGM8 nn6nxAbU /add' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial