Technical Information
Malicious functions
Injects code into
the following user processes:
- opera.exe
Modifies file system
Creates the following files
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive0.dat
- D:\users\user\appdata\local\temp\cab6eeb.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\0da515f703bb9b49479e8697adb0b955_4136d3715888e22d65ebe484b233d81b
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\0da515f703bb9b49479e8697adb0b955_4136d3715888e22d65ebe484b233d81b
- D:\users\user\appdata\local\temp\tar6e5d.tmp
- D:\users\user\appdata\local\temp\cab6e5c.tmp
- D:\users\user\appdata\local\temp\tar6dee.tmp
- D:\users\user\appdata\local\temp\cab6ded.tmp
- D:\users\user\appdata\local\temp\tar6d6f.tmp
- D:\users\user\appdata\local\temp\cab6d6e.tmp
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\kghpb0itoyszxa3l3z4v.temp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b4b.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b3a.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b28.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6971.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6960.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6883.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\67f5.tmp
- D:\users\user\appdata\local\temp\tar67a5.tmp
- D:\users\user\appdata\local\temp\cab67a4.tmp
- D:\users\user\appdata\local\temp\tar6eec.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00000a
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\50cd3d75d026c82e2e718570bd6f44d0_9fd00d8f214e1b169d00356034bf9d82
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\50cd3d75d026c82e2e718570bd6f44d0_9fd00d8f214e1b169d00356034bf9d82
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b77.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b56.tmp
- D:\users\user\appdata\local\temp\tar7b15.tmp
- D:\users\user\appdata\local\temp\cab7b14.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\349d186f1cb5682fa0194d4f3754ef36_97a2cb43e01f27293633b7b57353c80b
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\349d186f1cb5682fa0194d4f3754ef36_97a2cb43e01f27293633b7b57353c80b
- D:\users\user\appdata\local\temp\tar7a87.tmp
- D:\users\user\appdata\local\temp\cab7a86.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\795c.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\ea618097e393409afa316f0f87e2c202_1e65fd33f74047223af4d58cbfd34bce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\ea618097e393409afa316f0f87e2c202_1e65fd33f74047223af4d58cbfd34bce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b039fea45cb4cc4bbacfc013c7c55604_50d7940d5d3fedd8634d83074c7a46a3
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b039fea45cb4cc4bbacfc013c7c55604_50d7940d5d3fedd8634d83074c7a46a3
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00000b
- D:\users\user\appdata\local\temp\tar73ef.tmp
- D:\users\user\appdata\local\temp\cab73ee.tmp
- D:\users\user\appdata\local\temp\tar7361.tmp
- D:\users\user\appdata\local\temp\cab7360.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\50cd3d75d026c82e2e718570bd6f44d0_0ed6f6975a2fa9342e7ca861da15dbe6
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\50cd3d75d026c82e2e718570bd6f44d0_0ed6f6975a2fa9342e7ca861da15dbe6
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b88.tmp
- D:\users\user\appdata\local\temp\tar6774.tmp
- D:\users\user\appdata\local\temp\cab6773.tmp
- D:\users\user\appdata\local\temp\tar656f.tmp
- D:\users\user\appdata\local\temp\tar5ded.tmp
- D:\users\user\appdata\local\temp\cab5dec.tmp
- D:\users\user\appdata\local\temp\tar5ddb.tmp
- D:\users\user\appdata\local\temp\cab5dda.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000006
- D:\users\user\appdata\local\temp\tar5d9b.tmp
- D:\users\user\appdata\local\temp\tar5d9a.tmp
- D:\users\user\appdata\local\temp\cab5d88.tmp
- D:\users\user\appdata\local\temp\cab5d99.tmp
- D:\users\user\appdata\local\temp\tar5d68.tmp
- D:\users\user\appdata\local\temp\cab5d67.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\e0968a1e3a40d2582e7fd463baeb59cd
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e0968a1e3a40d2582e7fd463baeb59cd
- D:\users\user\appdata\local\temp\tar5d09.tmp
- D:\users\user\appdata\local\temp\cab5d08.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000005
- D:\users\user\appdata\local\temp\tar5c7a.tmp
- D:\users\user\appdata\local\temp\cab5c79.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000004
- D:\users\user\appdata\roaming\opera software\opera stable\local storage\opera_startpage_0.localstorage-journal
- D:\users\user\appdata\roaming\opera software\opera stable\local storage\opera_startpage_0.localstorage
- D:\users\user\appdata\local\temp\cab5f64.tmp
- D:\users\user\appdata\local\temp\tar5f65.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\72ba427a91f50409b9eac87f2b59b951_0882230bb4cf8678f89ce5840a75b765
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\72ba427a91f50409b9eac87f2b59b951_0882230bb4cf8678f89ce5840a75b765
- D:\users\user\appdata\local\temp\tar6500.tmp
- D:\users\user\appdata\local\temp\cab64ff.tmp
- D:\users\user\appdata\local\temp\tar6491.tmp
- D:\users\user\appdata\local\temp\cab6490.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000009
- D:\users\user\appdata\local\temp\tar6319.tmp
- D:\users\user\appdata\local\temp\cab6318.tmp
- D:\users\user\appdata\local\temp\cab62e7.tmp
- D:\users\user\appdata\local\temp\tar62e8.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000008
- D:\users\user\appdata\local\temp\tar60d3.tmp
- D:\users\user\appdata\local\temp\cab60d2.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000007
- D:\users\user\appdata\local\temp\tar5fb8.tmp
- D:\users\user\appdata\local\temp\cab5fb7.tmp
- D:\users\user\appdata\local\temp\tar5f97.tmp
- D:\users\user\appdata\local\temp\cab5f96.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\5f76.tmp
- D:\users\user\appdata\local\temp\cab655f.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7baa.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7bcb.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7c1b.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000010
- D:\users\user\appdata\roaming\opera software\opera stable\c6ff.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\c6b0.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00000f
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00000e
- D:\users\user\appdata\roaming\opera software\opera stable\b36d.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00000d
- D:\users\user\appdata\roaming\opera software\opera stable\siteprefs.json.new
- D:\users\user\appdata\roaming\opera software\opera stable\certificate revocation lists
- D:\users\user\appdata\local\temp\9b41.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000012
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\6bada8974a10c4bd62cc921d13e43b18_28dea62a0ae77228dd387e155ad0ba27
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\6bada8974a10c4bd62cc921d13e43b18_28dea62a0ae77228dd387e155ad0ba27
- D:\users\user\appdata\local\temp\tar9df9.tmp
- D:\users\user\appdata\local\temp\cab9df8.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\9d5b.tmp
- D:\users\user\appdata\local\temp\tar9ced.tmp
- D:\users\user\appdata\local\temp\cab9cec.tmp
- D:\users\user\appdata\local\temp\tar9ccc.tmp
- D:\users\user\appdata\local\temp\9b42.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000028
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000013
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000027
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000026
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000025
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000024
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000023
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000022
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000021
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000020
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00001f
- D:\users\user\appdata\local\temp\cab9ccb.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000011
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00001d
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00001c
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00001b
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00001a
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000019
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000018
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000017
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000016
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000015
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00001e
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000014
- D:\users\user\appdata\local\temp\tar9bff.tmp
- D:\users\user\appdata\local\temp\cab9bfe.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\61a70c70dd98c2bc8a9c7b5dd2b212aa
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\84b4.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8cd8.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8cc6.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8ca5.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8c64.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\e573cdf4c6d731d56a665145182fd759_08ad41ac196f2daeb2425e01257bbcd6
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e573cdf4c6d731d56a665145182fd759_08ad41ac196f2daeb2425e01257bbcd6
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
- D:\users\user\appdata\roaming\opera software\opera stable\86c7.tmp
- D:\users\user\appdata\local\temp\tar5aa4.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8dc6.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8464.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8433.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\83e3.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\83b2.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8362.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8331.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\7e4f.tmp
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\ebl4a3ca7editda6mdrj.temp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7ca9.tmp
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\a3ftrhnsj2zwaiha4ekk.temp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\93bf.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8e44.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\fubfzpvk2q30rh88n44b.temp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\61a70c70dd98c2bc8a9c7b5dd2b212aa
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\103621de9cd5414cc2538780b4b75751
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\103621de9cd5414cc2538780b4b75751
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\644b8874112055b5e195ecb0e8f243a4
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\644b8874112055b5e195ecb0e8f243a4
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8
- D:\users\user\appdata\roaming\opera software\opera stable\local storage\http_www.hero123.net_0.localstorage
- D:\users\user\appdata\roaming\opera software\opera stable\local storage\http_www.hero123.net_0.localstorage-journal
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\zloretx9xisrxtr6zhl2.temp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8cf9.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\938e.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\936d.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\933c.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00000c
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\930b.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\92ea.tmp
- D:\users\user\appdata\local\temp\tar8fad.tmp
- D:\users\user\appdata\local\temp\cab8fac.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\93e0.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\db5a.tmp
- D:\users\user\appdata\local\temp\cab5aa3.tmp
- D:\users\user\appdata\local\temp\tar580e.tmp
- D:\users\user\appdata\local\temp\tare9b4.tmp
- D:\users\user\appdata\local\temp\cabe9a3.tmp
- D:\users\user\appdata\local\temp\tare935.tmp
- D:\users\user\appdata\local\temp\cabe934.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\e8c6.tmp
- D:\users\user\appdata\local\temp\tare829.tmp
- D:\users\user\appdata\local\temp\cabe828.tmp
- D:\users\user\appdata\local\temp\tare817.tmp
- D:\users\user\appdata\local\temp\cabe816.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\1801a0bff52c676e5f51ca71c5350277
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\1801a0bff52c676e5f51ca71c5350277
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\8828f39c7c0ce9a14b25c7eb321181ba_d21e2eca16c426dd4124714500d479f2
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8828f39c7c0ce9a14b25c7eb321181ba_d21e2eca16c426dd4124714500d479f2
- D:\users\user\appdata\local\temp\tare74a.tmp
- D:\users\user\appdata\local\temp\cabe749.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015
- D:\users\user\appdata\roaming\opera software\opera stable\e64f.tmp
- D:\system volume information\syscache.hve
- D:\system volume information\syscache.hve.log1
- D:\users\user\appdata\local\temp\cabea22.tmp
- D:\users\user\appdata\local\temp\tarea23.tmp
- D:\users\user\appdata\local\temp\cabeadf.tmp
- D:\users\user\appdata\local\temp\cabeb10.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\session.db
- D:\users\user\appdata\local\temp\etilqs_22zas2j5rnjk6va
- D:\users\user\appdata\roaming\opera software\opera stable\session.db-journal
- D:\windows\system32\winevt\logs\system.evtx
- D:\windows\system32\winevt\logs\security.evtx
- D:\users\user\appdata\local\temp\tar3da.tmp
- D:\users\user\appdata\local\temp\cab3c9.tmp
- D:\users\user\appdata\local\temp\tar37a.tmp
- D:\users\user\appdata\local\temp\cab379.tmp
- D:\users\user\appdata\local\temp\cab26c.tmp
- D:\users\user\appdata\local\temp\tar27c.tmp
- D:\users\user\appdata\local\temp\tar27e.tmp
- D:\users\user\appdata\local\temp\cab27d.tmp
- D:\users\user\appdata\local\temp\tarf438.tmp
- D:\users\user\appdata\local\temp\cabf437.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\3fa0f92ea40dc353ff9e95b9f7d06eaf_02a7bb8d663ab0a2d3e0ce44422ed38b
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\3fa0f92ea40dc353ff9e95b9f7d06eaf_02a7bb8d663ab0a2d3e0ce44422ed38b
- D:\users\user\appdata\roaming\opera software\opera stable\ebdd.tmp
- D:\users\user\appdata\local\temp\tareae0.tmp
- D:\users\user\appdata\local\temp\tareb11.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\session.dbak
- D:\users\user\appdata\roaming\opera software\opera stable\e390.tmp
- D:\users\user\appdata\local\temp\tard636.tmp
- D:\users\user\appdata\local\temp\cabd635.tmp
- D:\users\user\appdata\local\temp\etilqs_epnxbccg7eeqv3h
- D:\users\user\appdata\roaming\opera software\opera stable\databases\databases.db-journal
- D:\users\user\appdata\roaming\opera software\opera stable\favicons
- D:\users\user\appdata\local\temp\etilqs_njvqrhnlrwzqspv
- D:\users\user\appdata\roaming\opera software\opera stable\favicons-journal
- D:\users\user\appdata\roaming\opera software\opera stable\history
- D:\users\user\appdata\roaming\opera software\opera stable\web data
- D:\users\user\appdata\local\temp\etilqs_uoxz820fkinam5c
- D:\users\user\appdata\roaming\opera software\opera stable\web data-journal
- D:\users\user\appdata\local\temp\etilqs_tgjucvwkmlrpsy0
- D:\users\user\appdata\roaming\opera software\opera stable\history-journal
- D:\users\user\appdata\roaming\opera software\opera stable\extension rules\log
- D:\users\user\appdata\roaming\opera software\opera stable\extension rules\000001.dbtmp
- D:\users\user\appdata\roaming\opera software\opera stable\extension rules\manifest-000001
- D:\users\user\ntuser.dat
- D:\users\user\ntuser.dat.log1
- D:\windows\system32\config\software
- D:\windows\system32\config\software.log1
- D:\windows\appcompat\programs\recentfilecache.bcf
- D:\users\user\appdata\roaming\opera software\opera stable\databases\databases.db
- D:\users\user\appdata\roaming\opera software\opera stable\quotamanager-journal
- D:\users\user\appdata\local\temp\etilqs_9vm7uhrllszplcu
- D:\users\user\appdata\roaming\opera software\opera stable\quotamanager
- D:\users\user\appdata\local\temp\cabd366.tmp
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\appdata\roaming\opera software\opera stable\cec3.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\data_3
- D:\users\user\appdata\local\opera software\opera stable\cache\data_2
- D:\users\user\appdata\local\opera software\opera stable\cache\data_1
- D:\users\user\appdata\local\opera software\opera stable\cache\data_0
- D:\users\user\appdata\local\opera software\opera stable\cache\index
- D:\users\user\appdata\local\temp\etilqs_lqxci33ddd0nwgf
- D:\users\user\appdata\roaming\opera software\opera stable\thumbnails.db
- D:\users\user\appdata\roaming\opera software\opera stable\thumbnails.db-journal
- D:\users\user\appdata\roaming\opera software\opera stable\favorites.db
- D:\users\user\appdata\roaming\opera software\opera stable\visited links
- D:\users\user\appdata\local\temp\etilqs_lixdrcjy15qohvq
- D:\users\user\appdata\roaming\opera software\opera stable\favorites.db-journal
- D:\users\user\appdata\roaming\opera software\opera stable\login data
- D:\users\user\appdata\local\temp\etilqs_ekb1zrlqiihhaqf
- D:\users\user\appdata\roaming\opera software\opera stable\login data-journal
- D:\users\user\appdata\roaming\opera software\opera stable\dictionaries\dictionaries.xml
- D:\users\user\appdata\local\temp\tard376.tmp
- D:\windows\system32\config\system.log1
- D:\windows\system32\config\system
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b398b80134f72209547439db21ab308d_a4cf52cca82d7458083f7280801a3a04
- D:\users\user\appdata\local\temp\tar4ea2.tmp
- D:\users\user\appdata\local\temp\cab4ea1.tmp
- D:\users\user\appdata\local\temp\tar4e23.tmp
- D:\users\user\appdata\local\temp\cab4e22.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\26b1f3b929b21508970f0865047de115
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\26b1f3b929b21508970f0865047de115
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\08d38664a849b9643a2699815901c19f
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\08d38664a849b9643a2699815901c19f
- D:\users\user\appdata\local\temp\tar4cba.tmp
- D:\users\user\appdata\local\temp\tar4c5a.tmp
- D:\users\user\appdata\local\temp\tar5058.tmp
- D:\users\user\appdata\local\temp\cab4c59.tmp
- D:\users\user\appdata\local\temp\tar48ef.tmp
- D:\users\user\appdata\local\temp\cab48ee.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b2faf7692fd9ffbd64ede317e42334ba_be25d0fe540174a4a87e2295c663329d
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b2faf7692fd9ffbd64ede317e42334ba_be25d0fe540174a4a87e2295c663329d
- D:\users\user\appdata\local\temp\tar4796.tmp
- D:\users\user\appdata\local\temp\cab4795.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000002
- D:\users\user\appdata\local\temp\cab4cb9.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\20eb32369c2ac86b6002a19d85c7f879
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b2faf7692fd9ffbd64ede317e42334ba_d7393c8f62bde4d4cb606228bc7a711e
- D:\users\user\appdata\local\temp\tar5a04.tmp
- D:\users\user\appdata\local\temp\tar5a16.tmp
- D:\users\user\appdata\local\temp\cab5a15.tmp
- D:\users\user\appdata\local\temp\cab5a03.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\e0f5c59f9fa661f6f4c50b87fef3a15a
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e0f5c59f9fa661f6f4c50b87fef3a15a
- D:\users\user\appdata\roaming\opera software\opera stable\5976.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\72ba427a91f50409b9eac87f2b59b951_adc7b0fc42f41a08b45656255dd84df2
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\72ba427a91f50409b9eac87f2b59b951_adc7b0fc42f41a08b45656255dd84df2
- D:\users\user\appdata\local\temp\tar4504.tmp
- D:\users\user\appdata\local\temp\cab5057.tmp
- D:\users\user\appdata\local\temp\tar55ac.tmp
- D:\users\user\appdata\local\temp\cab55ab.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\07cef2f654e3ed6050ffc9b6eb844250_bacc6cd2b29f18349081c9fd2343833b
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\07cef2f654e3ed6050ffc9b6eb844250_bacc6cd2b29f18349081c9fd2343833b
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000003
- D:\users\user\appdata\local\temp\tar5388.tmp
- D:\users\user\appdata\local\temp\cab5387.tmp
- D:\users\user\appdata\local\temp\tar5328.tmp
- D:\users\user\appdata\local\temp\cab5327.tmp
- D:\users\user\appdata\local\temp\cab580d.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b2faf7692fd9ffbd64ede317e42334ba_d7393c8f62bde4d4cb606228bc7a711e
- D:\users\user\appdata\local\temp\cab4503.tmp
- D:\users\user\appdata\local\temp\tar4090.tmp
- D:\users\user\appdata\local\temp\cab408f.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\manifest-000001
- D:\users\user\appdata\roaming\opera software\opera stable\2935.tmp
- D:\windows\system32\winevt\logs\application.evtx
- D:\users\user\appdata\local\temp\etilqs_wfc6f3mb7xe0maw
- D:\users\user\appdata\roaming\opera software\opera stable\extension state\000003.log
- D:\users\user\appdata\roaming\opera software\opera stable\extension state\log
- D:\users\user\appdata\roaming\opera software\opera stable\extension state\000001.dbtmp
- D:\users\user\appdata\roaming\opera software\opera stable\extension state\manifest-000001
- D:\users\user\appdata\roaming\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\20eb32369c2ac86b6002a19d85c7f879
- D:\users\user\appdata\roaming\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage
- D:\users\user\appdata\roaming\opera software\opera stable\cookies
- D:\users\user\appdata\local\temp\etilqs_82tttqvqp1t6klh
- D:\users\user\appdata\roaming\opera software\opera stable\cookies-journal
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b398b80134f72209547439db21ab308d_ade4e4d3a3bcbca5c39c54d362d88565
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b398b80134f72209547439db21ab308d_ade4e4d3a3bcbca5c39c54d362d88565
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b398b80134f72209547439db21ab308d_a4cf52cca82d7458083f7280801a3a04
- D:\users\user\appdata\roaming\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000001.dbtmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\19e0767fdeb3f34e0669b3834ce503c7
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000001
- D:\users\user\appdata\roaming\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000003.log
- D:\users\user\appdata\roaming\opera software\opera stable\2fdb.tmp
- D:\users\user\appdata\local\temp\tar3db0.tmp
- D:\users\user\appdata\local\temp\cab3daf.tmp
- D:\users\user\appdata\local\temp\tar3c96.tmp
- D:\users\user\appdata\local\temp\cab3c95.tmp
- D:\users\user\appdata\local\temp\tar3c55.tmp
- D:\users\user\appdata\local\temp\cab3c54.tmp
- D:\users\user\appdata\local\temp\tar3bf6.tmp
- D:\users\user\appdata\local\temp\cab3bf5.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\345e.tmp
- D:\users\user\appdata\local\temp\tar3be4.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage-journal
- D:\users\user\appdata\local\temp\cab3be3.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\35ddedf268117918d1d277a171d8df7b_9afed9e237441d6c8bd22a2d0b441b5a
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\35ddedf268117918d1d277a171d8df7b_9afed9e237441d6c8bd22a2d0b441b5a
- D:\users\user\appdata\local\temp\tar3740.tmp
- D:\users\user\appdata\local\temp\cab373f.tmp
- D:\users\user\appdata\local\temp\tar373e.tmp
- D:\users\user\appdata\local\temp\cab373d.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\346f.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\19e0767fdeb3f34e0669b3834ce503c7
- D:\users\user\appdata\roaming\opera software\opera stable\24c.tmp
Deletes the following files
- D:\users\user\appdata\local\temp\cabd366.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b18.tmp~rf166ab4.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b39.tmp~rf166ab4.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b4a.tmp~rf166ad3.tmp
- D:\users\user\appdata\local\temp\cab6d6e.tmp
- D:\users\user\appdata\local\temp\tar6d6f.tmp
- D:\users\user\appdata\local\temp\cab6ded.tmp
- D:\users\user\appdata\local\temp\tar6dee.tmp
- D:\users\user\appdata\local\temp\cab6e5c.tmp
- D:\users\user\appdata\local\temp\tar6e5d.tmp
- D:\users\user\appdata\local\temp\tar6eec.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b55.tmp~rf167aca.tmp
- D:\users\user\appdata\local\temp\cab7360.tmp
- D:\users\user\appdata\local\temp\tar7361.tmp
- D:\users\user\appdata\local\temp\cab73ee.tmp
- D:\users\user\appdata\local\temp\tar73ef.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\local state~rf1678e7.tmp
- D:\users\user\appdata\local\temp\cab7a86.tmp
- D:\users\user\appdata\local\temp\tar7a87.tmp
- D:\users\user\appdata\local\temp\cab7b14.tmp
- D:\users\user\appdata\local\temp\tar7b15.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6970.tmp~rf166a47.tmp
- D:\users\user\appdata\local\temp\cab6eeb.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\695f.tmp~rf1668ef.tmp
- D:\users\user\appdata\local\temp\tar6319.tmp
- D:\users\user\appdata\local\temp\cab5f96.tmp
- D:\users\user\appdata\local\temp\tar5f97.tmp
- D:\users\user\appdata\local\temp\cab5fb7.tmp
- D:\users\user\appdata\local\temp\tar5fb8.tmp
- D:\users\user\appdata\local\temp\cab60d2.tmp
- D:\users\user\appdata\local\temp\tar60d3.tmp
- D:\users\user\appdata\local\temp\cab62e7.tmp
- D:\users\user\appdata\local\temp\tar62e8.tmp
- D:\users\user\appdata\local\temp\cab6318.tmp
- D:\users\user\appdata\local\temp\cab6490.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\67f4.tmp~rf166789.tmp
- D:\users\user\appdata\local\temp\tar6491.tmp
- D:\users\user\appdata\local\temp\cab64ff.tmp
- D:\users\user\appdata\local\temp\tar6500.tmp
- D:\users\user\appdata\local\temp\cab655f.tmp
- D:\users\user\appdata\local\temp\tar656f.tmp
- D:\users\user\appdata\local\temp\cab6773.tmp
- D:\users\user\appdata\local\temp\tar6774.tmp
- D:\users\user\appdata\local\temp\cab67a4.tmp
- D:\users\user\appdata\local\temp\tar67a5.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6806.tmp~rf1668e0.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b66.tmp~rf167ae9.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b87.tmp~rf167af9.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7ba9.tmp~rf167b18.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\935c.tmp~rf16929e.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\937d.tmp~rf1692cd.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\93ae.tmp~rf1692fb.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\93cf.tmp~rf16932a.tmp
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms~rf1693b7.tmp
- D:\users\user\appdata\local\temp\cab9bfe.tmp
- D:\users\user\appdata\local\temp\tar9bff.tmp
- D:\users\user\appdata\local\temp\cab9ccb.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\930a.tmp~rf169250.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\932b.tmp~rf16927f.tmp
- D:\users\user\appdata\local\temp\tar9ccc.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\preferences~rf169c9c.tmp
- D:\users\user\appdata\local\temp\cab9df8.tmp
- D:\users\user\appdata\local\temp\tar9df9.tmp
- D:\users\user\appdata\local\temp\9b41.tmp
- D:\users\user\appdata\local\temp\9b42.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf16b28c.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\local state~rf16c5ce.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\preferences~rf16c61c.tmp
- D:\users\user\appdata\local\temp\cab9cec.tmp
- D:\users\user\appdata\local\temp\tar9ced.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\92e9.tmp~rf169231.tmp
- D:\users\user\appdata\local\temp\tar8fad.tmp
- D:\users\user\appdata\local\temp\cab8fac.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7c1a.tmp~rf167bf3.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7c99.tmp~rf167c6f.tmp
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms~rf167d2b.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8330.tmp~rf1682a7.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8361.tmp~rf1682f5.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\83a2.tmp~rf168314.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\83d2.tmp~rf168352.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8403.tmp~rf1683a0.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8453.tmp~rf1683cf.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7bba.tmp~rf167b37.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\84b3.tmp~rf16844c.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf1689f7.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8c63.tmp~rf168bbb.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8c85.tmp~rf168bf9.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8cb5.tmp~rf168c19.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8cd7.tmp~rf168c28.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8ce8.tmp~rf168c47.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8d77.tmp~rf168d60.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8e34.tmp~rf168d8f.tmp
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms~rf168e2b.tmp
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms~rf168545.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\bookmarks~rf165f10.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf16da86.tmp
- D:\users\user\appdata\local\temp\tar5f65.tmp
- D:\users\user\appdata\local\temp\tar5ddb.tmp
- D:\users\user\appdata\local\temp\tar27c.tmp
- D:\users\user\appdata\local\temp\cab379.tmp
- D:\users\user\appdata\local\temp\tar37a.tmp
- D:\users\user\appdata\local\temp\cab3c9.tmp
- D:\users\user\appdata\local\temp\tar3da.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\preferences~rf162951.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf163053.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\bookmarks~rf163449.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\local state~rf163468.tmp
- D:\users\user\appdata\local\temp\tar373e.tmp
- D:\users\user\appdata\local\temp\tar3c96.tmp
- D:\users\user\appdata\local\temp\cab373f.tmp
- D:\users\user\appdata\local\temp\tar3740.tmp
- D:\users\user\appdata\local\temp\cab3be3.tmp
- D:\users\user\appdata\local\temp\tar3be4.tmp
- D:\users\user\appdata\local\temp\cab3bf5.tmp
- D:\users\user\appdata\local\temp\tar3bf6.tmp
- D:\users\user\appdata\local\temp\cab3c54.tmp
- D:\users\user\appdata\local\temp\tar3c55.tmp
- D:\users\user\appdata\local\temp\cab3c95.tmp
- D:\users\user\appdata\local\temp\cab26c.tmp
- D:\users\user\appdata\local\temp\cab373d.tmp
- D:\users\user\appdata\local\temp\tar27e.tmp
- D:\users\user\appdata\local\temp\cabe934.tmp
- D:\users\user\appdata\local\temp\tard376.tmp
- D:\users\user\appdata\local\temp\cabd635.tmp
- D:\users\user\appdata\local\temp\tard636.tmp
- D:\users\user\appdata\local\temp\cabe749.tmp
- D:\users\user\appdata\local\temp\tare74a.tmp
- D:\users\user\appdata\local\temp\cabe816.tmp
- D:\users\user\appdata\local\temp\tare817.tmp
- D:\users\user\appdata\local\temp\cabe828.tmp
- D:\users\user\appdata\local\temp\tare829.tmp
- D:\users\user\appdata\local\temp\tare935.tmp
- D:\users\user\appdata\local\temp\tarf438.tmp
- D:\users\user\appdata\local\temp\cabe9a3.tmp
- D:\users\user\appdata\local\temp\tare9b4.tmp
- D:\users\user\appdata\local\temp\cabea22.tmp
- D:\users\user\appdata\local\temp\tarea23.tmp
- D:\users\user\appdata\local\temp\cabeb10.tmp
- D:\users\user\appdata\local\temp\tareb11.tmp
- D:\users\user\appdata\local\temp\cabeadf.tmp
- D:\users\user\appdata\local\temp\tareae0.tmp
- D:\users\user\appdata\local\temp\cabf437.tmp
- D:\users\user\appdata\local\temp\cab27d.tmp
- D:\users\user\appdata\local\temp\cab3daf.tmp
- D:\users\user\appdata\local\temp\tar3db0.tmp
- D:\users\user\appdata\local\temp\cab408f.tmp
- D:\users\user\appdata\local\temp\cab5a15.tmp
- D:\users\user\appdata\local\temp\tar5a16.tmp
- D:\users\user\appdata\local\temp\cab5a03.tmp
- D:\users\user\appdata\local\temp\tar5a04.tmp
- D:\users\user\appdata\local\temp\cab5aa3.tmp
- D:\users\user\appdata\local\temp\tar5aa4.tmp
- D:\users\user\appdata\local\temp\cab5c79.tmp
- D:\users\user\appdata\local\temp\tar5c7a.tmp
- D:\users\user\appdata\local\temp\tar580e.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf165956.tmp
- D:\users\user\appdata\local\temp\cab5d08.tmp
- D:\users\user\appdata\local\temp\tar5d68.tmp
- D:\users\user\appdata\local\temp\cab5d99.tmp
- D:\users\user\appdata\local\temp\cab5d88.tmp
- D:\users\user\appdata\local\temp\tar5d9a.tmp
- D:\users\user\appdata\local\temp\tar5d9b.tmp
- D:\users\user\appdata\local\temp\cab5dec.tmp
- D:\users\user\appdata\local\temp\tar5ded.tmp
- D:\users\user\appdata\local\temp\cab5dda.tmp
- D:\users\user\appdata\local\temp\tar5d09.tmp
- D:\users\user\appdata\local\temp\cab5d67.tmp
- D:\users\user\appdata\local\temp\cab580d.tmp
- D:\users\user\appdata\local\temp\tar55ac.tmp
- D:\users\user\appdata\local\temp\cab55ab.tmp
- D:\users\user\appdata\local\temp\cab4503.tmp
- D:\users\user\appdata\local\temp\tar4504.tmp
- D:\users\user\appdata\local\temp\cab4795.tmp
- D:\users\user\appdata\local\temp\tar4796.tmp
- D:\users\user\appdata\local\temp\cab48ee.tmp
- D:\users\user\appdata\local\temp\tar48ef.tmp
- D:\users\user\appdata\local\temp\cab4c59.tmp
- D:\users\user\appdata\local\temp\tar4c5a.tmp
- D:\users\user\appdata\local\temp\cab4cb9.tmp
- D:\users\user\appdata\local\temp\tar4090.tmp
- D:\users\user\appdata\local\temp\tar4cba.tmp
- D:\users\user\appdata\local\temp\tar4e23.tmp
- D:\users\user\appdata\local\temp\cab4ea1.tmp
- D:\users\user\appdata\local\temp\tar4ea2.tmp
- D:\users\user\appdata\local\temp\cab5057.tmp
- D:\users\user\appdata\local\temp\tar5058.tmp
- D:\users\user\appdata\local\temp\cab5327.tmp
- D:\users\user\appdata\local\temp\tar5328.tmp
- D:\users\user\appdata\local\temp\cab5387.tmp
- D:\users\user\appdata\local\temp\tar5388.tmp
- D:\users\user\appdata\local\temp\cab4e22.tmp
- D:\users\user\appdata\local\temp\cab5f64.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf170176.tmp
Moves the following files
- from D:\users\user\appdata\roaming\opera software\opera stable\extension rules\000001.dbtmp to D:\users\user\appdata\roaming\opera software\opera stable\extension rules\current
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8d77.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8d77.tmp~rf168d60.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8dc6.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8d77.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8ce8.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8ce8.tmp~rf168c47.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8cf9.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8ce8.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8cd7.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8cd7.tmp~rf168c28.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8cd8.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8cd7.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8cb5.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8cb5.tmp~rf168c19.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8cc6.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8cb5.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8c85.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8c85.tmp~rf168bf9.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8ca5.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8c85.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8c63.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8c63.tmp~rf168bbb.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8e44.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8e34.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8c64.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8c63.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\86c7.tmp to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity
- from D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms to D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms~rf168545.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\84b3.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\84b3.tmp~rf16844c.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\84b4.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\84b3.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8453.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8453.tmp~rf1683cf.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8464.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8453.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8403.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8403.tmp~rf1683a0.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8433.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8403.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\83d2.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\83d2.tmp~rf168352.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\83e3.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\83d2.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\83a2.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\83a2.tmp~rf168314.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf1689f7.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8e34.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8e34.tmp~rf168d8f.tmp
- from D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms to D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms~rf168e2b.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\92ea.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\92e9.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf16da86.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\db5a.tmp to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity
- from D:\users\user\appdata\roaming\opera software\opera stable\preferences to D:\users\user\appdata\roaming\opera software\opera stable\preferences~rf16c61c.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\c6ff.tmp to D:\users\user\appdata\roaming\opera software\opera stable\preferences
- from D:\users\user\appdata\roaming\opera software\opera stable\local state to D:\users\user\appdata\roaming\opera software\opera stable\local state~rf16c5ce.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\c6b0.tmp to D:\users\user\appdata\roaming\opera software\opera stable\local state
- from D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf16b28c.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\b36d.tmp to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity
- from D:\users\user\appdata\roaming\opera software\opera stable\siteprefs.json.new to D:\users\user\appdata\roaming\opera software\opera stable\siteprefs.json
- from D:\users\user\appdata\roaming\opera software\opera stable\preferences to D:\users\user\appdata\roaming\opera software\opera stable\preferences~rf169c9c.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\9d5b.tmp to D:\users\user\appdata\roaming\opera software\opera stable\preferences
- from D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms to D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms~rf1693b7.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\93cf.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\93cf.tmp~rf16932a.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\93e0.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\93cf.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\93ae.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\93ae.tmp~rf1692fb.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\93bf.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\93ae.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\937d.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\937d.tmp~rf1692cd.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\938e.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\937d.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\935c.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\935c.tmp~rf16929e.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\936d.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\935c.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\932b.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\932b.tmp~rf16927f.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\933c.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\932b.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\930a.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\930a.tmp~rf169250.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\930b.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\930a.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\92e9.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\92e9.tmp~rf169231.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\83b2.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\83a2.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\24c.tmp to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8361.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8361.tmp~rf1682f5.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8330.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8330.tmp~rf1682a7.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6960.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\695f.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6806.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6806.tmp~rf1668e0.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6883.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6806.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\67f4.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\67f4.tmp~rf166789.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\67f5.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\67f4.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\bookmarks to D:\users\user\appdata\roaming\opera software\opera stable\bookmarks~rf165f10.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\5f76.tmp to D:\users\user\appdata\roaming\opera software\opera stable\bookmarks
- from D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf165956.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\5976.tmp to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity
- from D:\users\user\appdata\roaming\opera software\opera stable\local state to D:\users\user\appdata\roaming\opera software\opera stable\local state~rf163468.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\346f.tmp to D:\users\user\appdata\roaming\opera software\opera stable\local state
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\695f.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\695f.tmp~rf1668ef.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\bookmarks to D:\users\user\appdata\roaming\opera software\opera stable\bookmarks~rf163449.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf163053.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\2fdb.tmp to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity
- from D:\users\user\appdata\roaming\opera software\opera stable\preferences to D:\users\user\appdata\roaming\opera software\opera stable\preferences~rf162951.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\2935.tmp to D:\users\user\appdata\roaming\opera software\opera stable\preferences
- from D:\users\user\appdata\roaming\opera software\opera stable\extension state\000001.dbtmp to D:\users\user\appdata\roaming\opera software\opera stable\extension state\current
- from D:\users\user\appdata\roaming\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000001.dbtmp to D:\users\user\appdata\roaming\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\current
- from D:\users\user\appdata\roaming\opera software\opera stable\ebdd.tmp to D:\users\user\appdata\roaming\opera software\opera stable\update_prefs.json
- from D:\users\user\appdata\roaming\opera software\opera stable\e8c6.tmp to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity
- from D:\users\user\appdata\roaming\opera software\opera stable\e64f.tmp to D:\users\user\appdata\roaming\opera software\opera stable\preferences
- from D:\users\user\appdata\roaming\opera software\opera stable\e390.tmp to D:\users\user\appdata\roaming\opera software\opera stable\local state
- from D:\users\user\appdata\roaming\opera software\opera stable\cec3.tmp to D:\users\user\appdata\roaming\opera software\opera stable\bookmarks
- from D:\users\user\appdata\roaming\opera software\opera stable\345e.tmp to D:\users\user\appdata\roaming\opera software\opera stable\bookmarks
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6971.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6970.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6970.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6970.tmp~rf166a47.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b28.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b18.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8331.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8330.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\7e4f.tmp to D:\users\user\appdata\roaming\opera software\opera stable\bookmarksextras
- from D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms to D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms~rf167d2b.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7c99.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7c99.tmp~rf167c6f.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7ca9.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7c99.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7c1a.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7c1a.tmp~rf167bf3.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7c1b.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7c1a.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7bba.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7bba.tmp~rf167b37.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7bcb.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7bba.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7ba9.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7ba9.tmp~rf167b18.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7baa.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7ba9.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b87.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b87.tmp~rf167af9.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b88.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b87.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b66.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b66.tmp~rf167ae9.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b77.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b66.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b55.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b55.tmp~rf167aca.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b56.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b55.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\local state to D:\users\user\appdata\roaming\opera software\opera stable\local state~rf1678e7.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\795c.tmp to D:\users\user\appdata\roaming\opera software\opera stable\local state
- from D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\kghpb0itoyszxa3l3z4v.temp to D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b4a.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b4a.tmp~rf166ad3.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b4b.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b4a.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b39.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b39.tmp~rf166ab4.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b3a.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b39.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b18.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b18.tmp~rf166ab4.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8362.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8361.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf170176.tmp
Substitutes the following files
- D:\users\user\appdata\roaming\opera software\opera stable\preferences
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8403.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8453.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\84b3.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8c63.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8c85.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8cb5.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\83a2.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\83d2.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8cd7.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8e34.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\92e9.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\930a.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\932b.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\935c.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\937d.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8ce8.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8d77.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8361.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\8330.tmp
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms
- D:\users\user\appdata\roaming\opera software\opera stable\bookmarks
- D:\users\user\appdata\roaming\opera software\opera stable\local state
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\67f4.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6806.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\695f.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6970.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b18.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b39.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b55.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b66.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7b87.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7ba9.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7bba.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7c1a.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\7c99.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\6b4a.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\93ae.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\93cf.tmp
Network activity
Connects to
- 'au######te.geo.opera.com':80
- 'sd#####es.operacdn.com':443
- 'md##z.com':443
- 'oc##.#ectigo.com':80
- 'sd#.51.la':80
- 'pu##.###nzhang.baidu.com':80
- 'tw##ter.com':80
- 'bo##ing.com':80
- 'en.###ipedia.org':443
- 'nl.##hoo.com':80
- 'tw##ter.com':443
- 's.##mg.com':443
- 'cf.##tatic.com':443
- 'cd##########on-opera-website.operacdn.com':443
- 'ab#.#wimg.com':443
- 'x1.#.lencr.org':80
- 'r3.#.lencr.org':80
- 'oc##.##ust-provider.cn':80
- 'ro###.ebay.com':443
- 'ro###.ebay.com':80
- 'cr#.###st-provider.cn':80
- 'st####.xx.fbcdn.net':443
- 'google.com':80
- 'se####.yahoo.com':80
- 'am##on.com':80
- 'du###uckgo.com':443
- 'bing.com':80
- 'en.###ipedia.org':80
- 'am##on.com':443
- 'do#####d5.operacdn.com':443
- 'bo##ing.com':443
- 'se####.yahoo.com':443
- 're###.opera.com':80
- 'fa###ook.com':80
- 'fa###ook.com':443
- 'he##123.net':80
- 'hn##fz.org':443
- 'jk##d.com':443
- 'hm.##idu.com':443
- 'au######te.geo.opera.com':443
- 'si#####ck2.opera.com':80
- 'ap#.##are.baidu.com':80
TCP
HTTP GET requests
- http://au######te.geo.opera.com/geolocation/
- http://www.bo##ing.com/index.html?ai##########################################################################################
- http://www.op##a.com/follow?ut###############################################################################################
- http://www.tw##ter.com/?pa################
- http://oc##.#ectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCECpuW4oiRXEuLvigEeWgmJo%3D
- http://www.he##123.net/uploads/allimg/230406/11-2304061UI70-L.jpg
- http://www.he##123.net/uploads/allimg/230407/11-23040G95Q80-L.png
- http://www.he##123.net/uploads/allimg/230404/11-2304040920120-L.jpg
- http://nl.##hoo.com/?il#####
- http://www.he##123.net/uploads/230411/11-2304111022551W.png
- http://oc##.##ust-provider.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQDhvjmfMdSVsHZ9u52p9jqu3rd8gQUXzp8ERB%2BDGdxYdyLo7UAA2f1VxwCECCDCtqroZkPhGc4X7YGZKQ%3D
- http://oc##.#ectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEQD8sVZeK8dAObkaltWeJkJz
- http://re###.opera.com/speeddials/partner/wikipedia_org_us
- http://re###.opera.com/speeddials/partner/youtube
- http://re###.opera.com/speeddials/partner/product
- http://www.he##123.net/templets/default/images/top_jtbx.jpg
- http://www.he##123.net/templets/default/images/top_6.jpg
- http://www.he##123.net/uploads/allimg/230403/11-2304031K2340-L.png
- http://www.he##123.net/templets/default/images/wmxyxb.jpg
- http://www.he##123.net/templets/default/images/wmxy.jpg
- http://www.he##123.net/templets/default/images/wmzt.jpg
- http://www.he##123.net/templets/default/images/button_08.png
- http://www.he##123.net/templets/default/images/button_07.png
- http://www.he##123.net/templets/default/images/button_06.png
- http://www.he##123.net/templets/default/images/button_05.png
- http://www.he##123.net/templets/default/images/button_04.png
- http://www.he##123.net/templets/default/images/button_03.png
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgNL%2Fv0Uc7gwMSltgjUw374BJg%3D%3D
- http://x1.#.lencr.org/
- http://www.he##123.net/templets/default/images/button_02.png
- http://www.he##123.net/templets/default/images/button_01.png
- http://pu##.###nzhang.baidu.com/push.js
- http://www.he##123.net/uploads/allimg/230316/11-2303161953350-L.png
- http://re###.opera.com/speeddials/partner/booking_com_us
- http://sd#.51.la/js-sdk-pro.min.js
- http://re###.opera.com/speeddials/partner/twitter_us
- http://re###.opera.com/speeddials/partner/yahoo
- http://www.he##123.net/templets/default/images/bg.jpg
- http://re###.opera.com/www.opera.com/firstrun/
- http://www.he##123.net/templets/default/css/index.css
- http://www.he##123.net/templets/default/css/basei.css
- http://www.he##123.net/templets/default/css/index67.css
- http://www.he##123.net/
- http://www.fa###ook.com/
- http://re###.opera.com/speeddials/partner/facebook
- http://si#####ck2.opera.com/?ho###################################################
- http://www.he##123.net/js.js
- http://si#####ck2.opera.com/?ho#######################################################
- http://en.###ipedia.org/favicon.ico
- http://www.bing.com/s/a/bing_p.ico
- http://se####.yahoo.com/favicon.ico
- http://www.am##on.com/favicon.ico
- http://www.google.com/favicon.ico
- http://www.he##123.net/templets/default/images/hxjzg.jpg
- http://www.he##123.net/uploads/allimg/230403/11-2304031106010-L.png
- http://www.he##123.net/templets/default/images/logo2.png
- http://www.he##123.net/templets/default/images/top_7.jpg
- http://www.he##123.net/templets/default/js/js/mf-pattern/mF_kdui.css
- http://oc##.##ust-provider.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQDhvjmfMdSVsHZ9u52p9jqu3rd8gQUXzp8ERB%2BDGdxYdyLo7UAA2f1VxwCECjKecELBf%2FINYq%2FpeYN884%3D
- http://oc##.##ust-provider.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQDhvjmfMdSVsHZ9u52p9jqu3rd8gQUXzp8ERB%2BDGdxYdyLo7UAA2f1VxwCEFpmfhlG4cuEmtj1bhp1t%2Fw%3D
- http://ro###.ebay.com/rover/1/711-53200-19255-0/1?ic###########################################################################################################################
- http://re###.opera.com/speeddials/partner/ebay_us
- http://re###.opera.com/speeddials/partner/amazon_us
- http://www.he##123.net/c/fonts/1415F2_3.ttf
- http://www.he##123.net/c/fonts/1415F2_4.ttf
- http://www.he##123.net/404.html
- http://www.he##123.net/c/fonts/1415F2_3.woff
- http://cr#.###st-provider.cn/TrustAsiaRSADVTLSCAG2.crt
- http://www.he##123.net/c/fonts/1415F2_4.woff
- http://www.he##123.net/templets/default/images/top_dwjl.jpg
- http://www.he##123.net/templets/default/images/top_5.jpg
- http://www.he##123.net/templets/default/images/top_kcjs.jpg
- http://www.he##123.net/templets/default/images/top_xsfz.jpg
- http://ap#.##are.baidu.com/s.gif?l=#######################
Other
- 'au######te.geo.opera.com':443
- 'cd##########on-opera-website.operacdn.com':443
- 'cf.##tatic.com':443
- 's.##mg.com':443
- 'ya##o.com':443
- 'tw##ter.com':443
- 'op##a.com':443
- 'bo##ing.com':443
- 'pa###.ebay.com':443
- 'eb##.com':443
- 'md##z.com':443
- 'ab#.#wimg.com':443
- 'sd#####es.operacdn.com':443
- 'st####.xx.fbcdn.net':443
- 'm.###ebook.com':443
- 'hm.##idu.com':443
- 'jk##d.com':443
- 'hn##fz.org':443
- 'fa###ook.com':443
- 'en.###ipedia.org':443
- 'se####.yahoo.com':443
- 'am##on.com':443
- 'du###uckgo.com':443
- 'ro###.ebay.com':443
- 'do#####d5.operacdn.com':443
UDP
- DNS ASK google.com
- DNS ASK md##z.com
- DNS ASK oc##.#ectigo.com
- DNS ASK eb##.com
- DNS ASK pu##.###nzhang.baidu.com
- DNS ASK sd#.51.la
- DNS ASK pa###.ebay.com
- DNS ASK op##a.com
- DNS ASK tw##ter.com
- DNS ASK bo##ing.com
- DNS ASK nl.##hoo.com
- DNS ASK ya##o.com
- DNS ASK s.##mg.com
- DNS ASK cf.##tatic.com
- DNS ASK cd##########on-opera-website.operacdn.com
- DNS ASK ab#.#wimg.com
- DNS ASK x1.#.lencr.org
- DNS ASK r3.#.lencr.org
- DNS ASK ah###ghting.com
- DNS ASK do#####d5.operacdn.com
- DNS ASK sd#####es.operacdn.com
- DNS ASK ro###.ebay.com
- DNS ASK au######te.geo.opera.com
- DNS ASK am##on.com
- DNS ASK se####.yahoo.com
- DNS ASK du###uckgo.com
- DNS ASK bi##.#ikimedia.org
- DNS ASK bing.com
- DNS ASK en.###ipedia.org
- DNS ASK si#####ck2.opera.com
- DNS ASK re###.opera.com
- DNS ASK fa###ook.com
- DNS ASK he##123.net
- DNS ASK hn##fz.org
- DNS ASK jk##d.com
- DNS ASK hm.##idu.com
- DNS ASK m.###ebook.com
- DNS ASK st####.xx.fbcdn.net
- DNS ASK cr#.###st-provider.cn
- DNS ASK oc##.##ust-provider.cn
- DNS ASK ap#.##are.baidu.com
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'Opera_MessageWindow' WindowName: 'C:\Users\user\AppData\Roaming\Opera Software\Opera Stable'
Creates and executes the following
- 'D:\program files (x86)\opera\launcher.exe' -noautoupdate -- "http://www.hero123.net/"' (with hidden window)
