Technical Information
Malicious functions
Injects code into
the following user processes:
- opera.exe
Modifies file system
Creates the following files
- D:\windows\appcompat\programs\recentfilecache.bcf
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000007
- D:\users\user\appdata\roaming\opera software\opera stable\local storage\opera_startpage_0.localstorage
- D:\users\user\appdata\roaming\opera software\opera stable\local storage\opera_startpage_0.localstorage-journal
- D:\users\user\appdata\roaming\opera software\opera stable\306d.tmp
- D:\users\user\appdata\local\temp\tar2e88.tmp
- D:\users\user\appdata\local\temp\cab2e87.tmp
- D:\users\user\appdata\local\temp\tar2dfa.tmp
- D:\users\user\appdata\local\temp\cab2df9.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\ea618097e393409afa316f0f87e2c202_1e65fd33f74047223af4d58cbfd34bce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\ea618097e393409afa316f0f87e2c202_1e65fd33f74047223af4d58cbfd34bce
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000006
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000005
- D:\users\user\appdata\local\temp\tar2acd.tmp
- D:\users\user\appdata\local\temp\cab2acc.tmp
- D:\users\user\appdata\local\temp\tar2a6d.tmp
- D:\users\user\appdata\local\temp\cab2a6c.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\72ba427a91f50409b9eac87f2b59b951_0882230bb4cf8678f89ce5840a75b765
- D:\users\user\appdata\local\temp\tar29bf.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\72ba427a91f50409b9eac87f2b59b951_0882230bb4cf8678f89ce5840a75b765
- D:\users\user\appdata\roaming\opera software\opera stable\local storage\http_www.hero123.net_0.localstorage-journal
- D:\users\user\appdata\roaming\opera software\opera stable\local storage\http_www.hero123.net_0.localstorage
- D:\users\user\appdata\local\temp\cab4232.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\50cd3d75d026c82e2e718570bd6f44d0_0ed6f6975a2fa9342e7ca861da15dbe6
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\50cd3d75d026c82e2e718570bd6f44d0_0ed6f6975a2fa9342e7ca861da15dbe6
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00000a
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000009
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000008
- D:\users\user\appdata\local\temp\tar3ce4.tmp
- D:\users\user\appdata\local\temp\cab3ce3.tmp
- D:\users\user\appdata\local\temp\cab3b0d.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e0968a1e3a40d2582e7fd463baeb59cd
- D:\users\user\appdata\local\temp\tar3add.tmp
- D:\users\user\appdata\local\temp\cab3adc.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8
- D:\users\user\appdata\roaming\opera software\opera stable\3a7e.tmp
- D:\users\user\appdata\local\temp\tar3926.tmp
- D:\users\user\appdata\local\temp\cab3925.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce
- D:\users\user\appdata\local\temp\cab29af.tmp
- D:\users\user\appdata\local\temp\tar2941.tmp
- D:\users\user\appdata\local\temp\cab2940.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b2faf7692fd9ffbd64ede317e42334ba_d7393c8f62bde4d4cb606228bc7a711e
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b2faf7692fd9ffbd64ede317e42334ba_d7393c8f62bde4d4cb606228bc7a711e
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b2faf7692fd9ffbd64ede317e42334ba_be25d0fe540174a4a87e2295c663329d
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b2faf7692fd9ffbd64ede317e42334ba_be25d0fe540174a4a87e2295c663329d
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\0da515f703bb9b49479e8697adb0b955_4136d3715888e22d65ebe484b233d81b
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\0da515f703bb9b49479e8697adb0b955_4136d3715888e22d65ebe484b233d81b
- D:\users\user\appdata\local\temp\tar12cf.tmp
- D:\users\user\appdata\local\temp\cab12ce.tmp
- D:\users\user\appdata\local\temp\tar11c4.tmp
- D:\users\user\appdata\local\temp\cab11b3.tmp
- D:\users\user\appdata\local\temp\tar1135.tmp
- D:\users\user\appdata\local\temp\cab1134.tmp
- D:\users\user\appdata\local\temp\tarfec.tmp
- D:\users\user\appdata\local\temp\cabfeb.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\19e0767fdeb3f34e0669b3834ce503c7
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\19e0767fdeb3f34e0669b3834ce503c7
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b039fea45cb4cc4bbacfc013c7c55604_50d7940d5d3fedd8634d83074c7a46a3
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\07cef2f654e3ed6050ffc9b6eb844250_bacc6cd2b29f18349081c9fd2343833b
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b039fea45cb4cc4bbacfc013c7c55604_50d7940d5d3fedd8634d83074c7a46a3
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\07cef2f654e3ed6050ffc9b6eb844250_bacc6cd2b29f18349081c9fd2343833b
- D:\users\user\appdata\local\temp\tar2845.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\349d186f1cb5682fa0194d4f3754ef36_97a2cb43e01f27293633b7b57353c80b
- D:\users\user\appdata\local\temp\cab2844.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\e0f5c59f9fa661f6f4c50b87fef3a15a
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e0f5c59f9fa661f6f4c50b87fef3a15a
- D:\users\user\appdata\roaming\opera software\opera stable\27b7.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\20eb32369c2ac86b6002a19d85c7f879
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\20eb32369c2ac86b6002a19d85c7f879
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000004
- D:\users\user\appdata\local\temp\tar3b0e.tmp
- D:\users\user\appdata\local\temp\tar4233.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000003
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\08d38664a849b9643a2699815901c19f
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\08d38664a849b9643a2699815901c19f
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\26b1f3b929b21508970f0865047de115
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\26b1f3b929b21508970f0865047de115
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\72ba427a91f50409b9eac87f2b59b951_adc7b0fc42f41a08b45656255dd84df2
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\72ba427a91f50409b9eac87f2b59b951_adc7b0fc42f41a08b45656255dd84df2
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\349d186f1cb5682fa0194d4f3754ef36_97a2cb43e01f27293633b7b57353c80b
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\e0968a1e3a40d2582e7fd463baeb59cd
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5b8a.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000026
- D:\users\user\appdata\local\temp\cab44d5.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000013
- D:\users\user\appdata\roaming\opera software\opera stable\9383.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000012
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000011
- D:\users\user\appdata\roaming\opera software\opera stable\8b48.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000010
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00000f
- D:\users\user\appdata\roaming\opera software\opera stable\7ca7.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00000e
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00000d
- D:\users\user\appdata\roaming\opera software\opera stable\siteprefs.json.new
- D:\users\user\appdata\roaming\opera software\opera stable\certificate revocation lists
- D:\users\user\appdata\local\temp\5fbb.tmp
- D:\users\user\appdata\local\temp\5fba.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\6bada8974a10c4bd62cc921d13e43b18_28dea62a0ae77228dd387e155ad0ba27
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\6bada8974a10c4bd62cc921d13e43b18_28dea62a0ae77228dd387e155ad0ba27
- D:\users\user\appdata\local\temp\tar6282.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\61f3.tmp
- D:\users\user\appdata\local\temp\cab6281.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000014
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000015
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000025
- D:\users\user\appdata\roaming\opera software\opera stable\cea1.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000024
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000023
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000022
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000021
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000020
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00001f
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00001d
- D:\users\user\appdata\local\temp\cab437c.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00001c
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00001b
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00001a
- D:\users\user\appdata\roaming\opera software\opera stable\a540.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000019
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000018
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000017
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000016
- D:\users\user\appdata\local\temp\tar6195.tmp
- D:\users\user\appdata\local\temp\cab6184.tmp
- D:\users\user\appdata\local\temp\tar6164.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5275.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\61a70c70dd98c2bc8a9c7b5dd2b212aa
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\61a70c70dd98c2bc8a9c7b5dd2b212aa
- D:\users\user\appdata\roaming\opera software\opera stable\4dc2.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00000c
- D:\users\user\appdata\roaming\opera software\opera stable\4c89.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00000b
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\103621de9cd5414cc2538780b4b75751
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\103621de9cd5414cc2538780b4b75751
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\644b8874112055b5e195ecb0e8f243a4
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\644b8874112055b5e195ecb0e8f243a4
- D:\users\user\appdata\local\temp\tar45e3.tmp
- D:\users\user\appdata\local\temp\cab45e2.tmp
- D:\users\user\appdata\local\temp\tar4507.tmp
- D:\users\user\appdata\local\temp\cab4506.tmp
- D:\users\user\appdata\local\temp\tar44d6.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\50cd3d75d026c82e2e718570bd6f44d0_9fd00d8f214e1b169d00356034bf9d82
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5296.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\50cd3d75d026c82e2e718570bd6f44d0_9fd00d8f214e1b169d00356034bf9d82
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\52b7.tmp
- D:\users\user\appdata\local\temp\cab6163.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55b6.tmp
- D:\users\user\appdata\local\temp\tar6087.tmp
- D:\users\user\appdata\local\temp\cab6086.tmp
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\8ohoghvlkairbld5ljja.temp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5ecf.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5ebd.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5e9c.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5e5b.tmp
- D:\users\user\appdata\local\temp\tarf9c.tmp
- D:\users\user\appdata\local\temp\tar437d.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5aec.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\e573cdf4c6d731d56a665145182fd759_08ad41ac196f2daeb2425e01257bbcd6
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e573cdf4c6d731d56a665145182fd759_08ad41ac196f2daeb2425e01257bbcd6
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\ob4ovfbelafjd1nts1vf.temp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55fa.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55e9.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55c7.tmp
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive0.dat
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5e1b.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_00001e
- D:\users\user\appdata\local\temp\cabf9b.tmp
- D:\users\user\appdata\local\temp\tar9f4.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\cookies-journal
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015
- D:\users\user\appdata\local\temp\tara533.tmp
- D:\users\user\appdata\local\temp\caba532.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\a502.tmp
- D:\users\user\appdata\local\temp\tar9fe3.tmp
- D:\users\user\appdata\local\temp\cab9fe2.tmp
- D:\users\user\appdata\local\temp\tar9dfd.tmp
- D:\users\user\appdata\local\temp\cab9dfc.tmp
- D:\users\user\appdata\local\temp\tar9a23.tmp
- D:\users\user\appdata\local\temp\cab9a22.tmp
- D:\users\user\appdata\local\temp\tar9a34.tmp
- D:\users\user\appdata\local\temp\cab9a33.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\1801a0bff52c676e5f51ca71c5350277
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\1801a0bff52c676e5f51ca71c5350277
- D:\users\user\appdata\local\temp\tar98e9.tmp
- D:\users\user\appdata\local\temp\cab98e8.tmp
- D:\users\user\appdata\local\temp\cab97bd.tmp
- D:\users\user\appdata\local\temp\tar97ce.tmp
- D:\users\user\appdata\local\temp\caba573.tmp
- D:\users\user\appdata\local\temp\tara574.tmp
- D:\users\user\appdata\local\temp\tara751.tmp
- D:\users\user\appdata\local\temp\caba750.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\8828f39c7c0ce9a14b25c7eb321181ba_d21e2eca16c426dd4124714500d479f2
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8828f39c7c0ce9a14b25c7eb321181ba_d21e2eca16c426dd4124714500d479f2
- D:\users\user\appdata\local\temp\tara6c2.tmp
- D:\users\user\appdata\local\temp\caba6c1.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\a615.tmp
- D:\users\user\appdata\local\temp\tara5d5.tmp
- D:\users\user\appdata\local\temp\tara5a4.tmp
- D:\users\user\appdata\local\temp\etilqs_yeq8rsabhsaunsr
- D:\users\user\appdata\local\temp\caba5a3.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\gpucache\data_3
- D:\users\user\appdata\roaming\opera software\opera stable\gpucache\data_2
- D:\users\user\appdata\roaming\opera software\opera stable\gpucache\data_1
- D:\users\user\appdata\roaming\opera software\opera stable\gpucache\data_0
- D:\users\user\appdata\roaming\opera software\opera stable\cookies
- D:\users\user\appdata\roaming\opera software\opera stable\gpucache\index
- D:\users\user\appdata\local\temp\etilqs_ekoyojpkmvmahhu
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\appdata\roaming\opera software\opera stable\9231.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\favicons
- D:\users\user\ntuser.dat.log1
- D:\users\user\appdata\local\temp\etilqs_vwmseklqr2y3rcb
- D:\users\user\appdata\roaming\opera software\opera stable\favicons-journal
- D:\users\user\appdata\roaming\opera software\opera stable\history
- D:\users\user\appdata\roaming\opera software\opera stable\web data
- D:\users\user\appdata\local\temp\etilqs_bhmnzriyvnpmzw9
- D:\users\user\appdata\roaming\opera software\opera stable\web data-journal
- D:\users\user\appdata\local\temp\etilqs_t1uj26mltvo6jjs
- D:\users\user\appdata\roaming\opera software\opera stable\history-journal
- D:\users\user\appdata\roaming\opera software\opera stable\extension rules\log
- D:\users\user\appdata\roaming\opera software\opera stable\extension rules\000001.dbtmp
- D:\users\user\appdata\roaming\opera software\opera stable\extension rules\manifest-000001
- D:\windows\system32\config\software
- D:\windows\system32\config\software.log1
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
- D:\users\user\appdata\roaming\opera software\opera stable\databases\databases.db-journal
- D:\users\user\appdata\local\temp\etilqs_j8d4ezmcihoph1q
- D:\users\user\ntuser.dat
- D:\users\user\appdata\roaming\opera software\opera stable\databases\databases.db
- D:\users\user\appdata\local\opera software\opera stable\cache\data_3
- D:\users\user\appdata\roaming\opera software\opera stable\quotamanager-journal
- D:\users\user\appdata\local\opera software\opera stable\cache\data_2
- D:\users\user\appdata\local\opera software\opera stable\cache\data_1
- D:\users\user\appdata\local\opera software\opera stable\cache\data_0
- D:\users\user\appdata\local\opera software\opera stable\cache\index
- D:\users\user\appdata\roaming\opera software\opera stable\thumbnails.db
- D:\users\user\appdata\local\temp\etilqs_hbjbpxz9wy42lux
- D:\users\user\appdata\roaming\opera software\opera stable\thumbnails.db-journal
- D:\users\user\appdata\local\temp\caba5d4.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\a7ee.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\favorites.db-journal
- D:\users\user\appdata\roaming\opera software\opera stable\visited links
- D:\users\user\appdata\roaming\opera software\opera stable\login data
- D:\users\user\appdata\local\temp\etilqs_plljngzzgnxmte6
- D:\users\user\appdata\roaming\opera software\opera stable\login data-journal
- D:\users\user\appdata\roaming\opera software\opera stable\dictionaries\dictionaries.xml
- D:\users\user\appdata\roaming\opera software\opera stable\quotamanager
- D:\users\user\appdata\local\temp\etilqs_8alxylelsf8phux
- D:\users\user\appdata\roaming\opera software\opera stable\favorites.db
- D:\users\user\appdata\local\temp\tarb7b7.tmp
- D:\users\user\appdata\local\temp\cabf6a.tmp
- D:\users\user\appdata\local\temp\cabae36.tmp
- D:\windows\system32\config\system
- D:\windows\system32\config\system.log1
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\35ddedf268117918d1d277a171d8df7b_9afed9e237441d6c8bd22a2d0b441b5a
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\35ddedf268117918d1d277a171d8df7b_9afed9e237441d6c8bd22a2d0b441b5a
- D:\windows\system32\winevt\logs\security.evtx
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\edc238bff48a31d55a97e1e93892934b_c20e0da2d0f89fe526e1490f4a2ee5ab
- D:\users\user\appdata\roaming\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage
- D:\users\user\appdata\roaming\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage-journal
- D:\windows\system32\winevt\logs\system.evtx
- D:\users\user\appdata\roaming\opera software\opera stable\c2ef.tmp
- D:\users\user\appdata\local\temp\tarbe8b.tmp
- D:\users\user\appdata\local\temp\cabbe8a.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000003.log
- D:\users\user\appdata\local\temp\tarbd51.tmp
- D:\users\user\appdata\local\temp\cabbd50.tmp
- D:\users\user\appdata\local\temp\tarbb9a.tmp
- D:\users\user\appdata\local\temp\tarbb69.tmp
- D:\users\user\appdata\local\temp\cabbb99.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\d4fa.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\d4fb.tmp
- D:\users\user\appdata\local\temp\tarefc.tmp
- D:\users\user\appdata\local\temp\cabefb.tmp
- D:\users\user\appdata\local\temp\tareda.tmp
- D:\users\user\appdata\local\temp\cabed9.tmp
- D:\users\user\appdata\local\temp\tare9a.tmp
- D:\users\user\appdata\local\temp\cabe89.tmp
- D:\users\user\appdata\local\temp\tare5a.tmp
- D:\users\user\appdata\local\temp\cabe59.tmp
- D:\users\user\appdata\local\temp\cab9f3.tmp
- D:\system volume information\syscache.hve.log1
- D:\users\user\appdata\local\temp\tar9e3.tmp
- D:\users\user\appdata\local\temp\cab9e2.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000002
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000001
- D:\users\user\appdata\local\temp\etilqs_vg6ng2s43nwbae1
- D:\windows\system32\winevt\logs\application.evtx
- D:\users\user\appdata\roaming\opera software\opera stable\d73d.tmp
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\users\user\appdata\local\temp\cabbb68.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log
- D:\users\user\appdata\roaming\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000001.dbtmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b398b80134f72209547439db21ab308d_ade4e4d3a3bcbca5c39c54d362d88565
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\3fa0f92ea40dc353ff9e95b9f7d06eaf_02a7bb8d663ab0a2d3e0ce44422ed38b
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\3fa0f92ea40dc353ff9e95b9f7d06eaf_02a7bb8d663ab0a2d3e0ce44422ed38b
- D:\users\user\appdata\roaming\opera software\opera stable\session.db
- D:\users\user\appdata\roaming\opera software\opera stable\b1f7.tmp
- D:\users\user\appdata\local\temp\etilqs_8ph77drsz4p4cjd
- D:\users\user\appdata\roaming\opera software\opera stable\session.db-journal
- D:\users\user\appdata\local\temp\tarb14a.tmp
- D:\users\user\appdata\local\temp\cabb149.tmp
- D:\users\user\appdata\local\temp\tarb10a.tmp
- D:\users\user\appdata\local\temp\cabb0f9.tmp
- D:\users\user\appdata\local\temp\tarb0e9.tmp
- D:\users\user\appdata\local\temp\cabb0e8.tmp
- D:\users\user\appdata\local\temp\tarae38.tmp
- D:\users\user\appdata\local\temp\tarae37.tmp
- D:\users\user\appdata\local\temp\cabae35.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\session.dbak
- D:\users\user\appdata\local\temp\cabb2c3.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b398b80134f72209547439db21ab308d_ade4e4d3a3bcbca5c39c54d362d88565
- D:\users\user\appdata\local\temp\tarb2c4.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\manifest-000001
- D:\users\user\appdata\roaming\opera software\opera stable\extension state\manifest-000001
- D:\users\user\appdata\local\temp\tarb917.tmp
- D:\users\user\appdata\local\temp\cabb916.tmp
- D:\users\user\appdata\local\temp\tarb8e6.tmp
- D:\users\user\appdata\local\temp\cabb8e5.tmp
- D:\users\user\appdata\local\temp\tarb857.tmp
- D:\users\user\appdata\local\temp\cabb856.tmp
- D:\users\user\appdata\local\temp\tarb836.tmp
- D:\users\user\appdata\local\temp\tarf6b.tmp
- D:\system volume information\syscache.hve
- D:\users\user\appdata\local\temp\cabb7b6.tmp
- D:\users\user\appdata\local\temp\tarb739.tmp
- D:\users\user\appdata\local\temp\cabb738.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\extension state\000003.log
- D:\users\user\appdata\roaming\opera software\opera stable\extension state\log
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b398b80134f72209547439db21ab308d_a4cf52cca82d7458083f7280801a3a04
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b398b80134f72209547439db21ab308d_a4cf52cca82d7458083f7280801a3a04
- D:\users\user\appdata\roaming\opera software\opera stable\extension state\000001.dbtmp
- D:\users\user\appdata\local\temp\cabb835.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000027
Deletes the following files
- D:\users\user\appdata\local\temp\cab97bd.tmp
- D:\users\user\appdata\local\temp\cab2e87.tmp
- D:\users\user\appdata\local\temp\tar2e88.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\bookmarks~rf163072.tmp
- D:\users\user\appdata\local\temp\cab3925.tmp
- D:\users\user\appdata\local\temp\tar3926.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\local state~rf163a22.tmp
- D:\users\user\appdata\local\temp\cab3adc.tmp
- D:\users\user\appdata\local\temp\tar3add.tmp
- D:\users\user\appdata\local\temp\cab3b0d.tmp
- D:\users\user\appdata\local\temp\tar3b0e.tmp
- D:\users\user\appdata\local\temp\cab3ce3.tmp
- D:\users\user\appdata\local\temp\tar3ce4.tmp
- D:\users\user\appdata\local\temp\cab4232.tmp
- D:\users\user\appdata\local\temp\tar4233.tmp
- D:\users\user\appdata\local\temp\cab437c.tmp
- D:\users\user\appdata\local\temp\tar2dfa.tmp
- D:\users\user\appdata\local\temp\tarfec.tmp
- D:\users\user\appdata\local\temp\cab2df9.tmp
- D:\users\user\appdata\local\temp\cab2acc.tmp
- D:\users\user\appdata\local\temp\tar1135.tmp
- D:\users\user\appdata\local\temp\cab11b3.tmp
- D:\users\user\appdata\local\temp\tar11c4.tmp
- D:\users\user\appdata\local\temp\cab12ce.tmp
- D:\users\user\appdata\local\temp\tar12cf.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf16276d.tmp
- D:\users\user\appdata\local\temp\cab2844.tmp
- D:\users\user\appdata\local\temp\tar2845.tmp
- D:\users\user\appdata\local\temp\cab2940.tmp
- D:\users\user\appdata\local\temp\tar2941.tmp
- D:\users\user\appdata\local\opera software\opera stable\cache\f_000004
- D:\users\user\appdata\local\temp\cab29af.tmp
- D:\users\user\appdata\local\temp\tar29bf.tmp
- D:\users\user\appdata\local\temp\cab2a6c.tmp
- D:\users\user\appdata\local\temp\tar2a6d.tmp
- D:\users\user\appdata\local\temp\tar2acd.tmp
- D:\users\user\appdata\local\temp\cab1134.tmp
- D:\users\user\appdata\local\temp\tar437d.tmp
- D:\users\user\appdata\local\temp\tar4507.tmp
- D:\users\user\appdata\local\temp\cab6086.tmp
- D:\users\user\appdata\local\temp\tar6087.tmp
- D:\users\user\appdata\local\temp\cab6163.tmp
- D:\users\user\appdata\local\temp\tar6164.tmp
- D:\users\user\appdata\local\temp\cab6184.tmp
- D:\users\user\appdata\local\temp\tar6195.tmp
- D:\users\user\appdata\local\temp\tarb917.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\preferences~rf166171.tmp
- D:\users\user\appdata\local\temp\tar6282.tmp
- D:\users\user\appdata\local\temp\5fba.tmp
- D:\users\user\appdata\local\temp\5fbb.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf167c02.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\local state~rf168aa2.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\preferences~rf1692dc.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5ece.tmp~rf165e55.tmp
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms~rf165f20.tmp
- D:\users\user\appdata\local\temp\tar44d6.tmp
- D:\users\user\appdata\local\temp\cab44d5.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5e5a.tmp~rf165df7.tmp
- D:\users\user\appdata\local\temp\cab45e2.tmp
- D:\users\user\appdata\local\temp\tar45e3.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf164d54.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5274.tmp~rf165206.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5295.tmp~rf165225.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\52a7.tmp~rf1652e0.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5364.tmp~rf165540.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55c6.tmp~rf165550.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55e8.tmp~rf165560.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55f9.tmp~rf16557f.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5aeb.tmp~rf165aad.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5b3b.tmp~rf165d1d.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5dbc.tmp~rf165db9.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5e8b.tmp~rf165e16.tmp
- D:\users\user\appdata\local\temp\cab4506.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5ebc.tmp~rf165e36.tmp
- D:\users\user\appdata\local\temp\cabfeb.tmp
- D:\users\user\appdata\local\temp\tarf9c.tmp
- D:\users\user\appdata\local\temp\cabf9b.tmp
- D:\users\user\appdata\local\temp\tara6c2.tmp
- D:\users\user\appdata\local\temp\caba750.tmp
- D:\users\user\appdata\local\temp\tara751.tmp
- D:\users\user\appdata\local\temp\cabae36.tmp
- D:\users\user\appdata\local\temp\tarae37.tmp
- D:\users\user\appdata\local\temp\cabae35.tmp
- D:\users\user\appdata\local\temp\tarae38.tmp
- D:\users\user\appdata\local\temp\cabb0e8.tmp
- D:\users\user\appdata\local\temp\tarb0e9.tmp
- D:\users\user\appdata\local\temp\cabb0f9.tmp
- D:\users\user\appdata\local\temp\tarb10a.tmp
- D:\users\user\appdata\local\temp\cabb149.tmp
- D:\users\user\appdata\local\temp\tarb14a.tmp
- D:\users\user\appdata\local\temp\cabb2c3.tmp
- D:\users\user\appdata\local\temp\tara5d5.tmp
- D:\users\user\appdata\local\temp\tarb2c4.tmp
- D:\users\user\appdata\local\temp\caba5d4.tmp
- D:\users\user\appdata\local\temp\caba5a3.tmp
- D:\users\user\appdata\local\temp\tar97ce.tmp
- D:\users\user\appdata\local\temp\cab98e8.tmp
- D:\users\user\appdata\local\temp\tar98e9.tmp
- D:\users\user\appdata\local\temp\cab9a33.tmp
- D:\users\user\appdata\local\temp\tar9a34.tmp
- D:\users\user\appdata\local\temp\cab9a22.tmp
- D:\users\user\appdata\local\temp\tar9a23.tmp
- D:\users\user\appdata\local\temp\cab9dfc.tmp
- D:\users\user\appdata\local\temp\tar9dfd.tmp
- D:\users\user\appdata\local\temp\cab9fe2.tmp
- D:\users\user\appdata\local\temp\tar9fe3.tmp
- D:\users\user\appdata\local\temp\caba532.tmp
- D:\users\user\appdata\local\temp\tara533.tmp
- D:\users\user\appdata\local\temp\caba573.tmp
- D:\users\user\appdata\local\temp\tara574.tmp
- D:\users\user\appdata\local\temp\tara5a4.tmp
- D:\users\user\appdata\local\temp\cabb738.tmp
- D:\users\user\appdata\local\temp\caba6c1.tmp
- D:\users\user\appdata\local\temp\tarb739.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf15d71c.tmp
- D:\users\user\appdata\local\temp\tar9e3.tmp
- D:\users\user\appdata\local\temp\cab9f3.tmp
- D:\users\user\appdata\local\temp\tar9f4.tmp
- D:\users\user\appdata\local\temp\cabe59.tmp
- D:\users\user\appdata\local\temp\tare5a.tmp
- D:\users\user\appdata\local\temp\cabe89.tmp
- D:\users\user\appdata\local\temp\tare9a.tmp
- D:\users\user\appdata\local\temp\cabed9.tmp
- D:\users\user\appdata\local\temp\tareda.tmp
- D:\users\user\appdata\local\temp\cabefb.tmp
- D:\users\user\appdata\local\temp\tarefc.tmp
- D:\users\user\appdata\local\temp\cabf6a.tmp
- D:\users\user\appdata\local\temp\tarf6b.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\local state~rf15d4fa.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\bookmarks~rf15c36d.tmp
- D:\users\user\appdata\local\temp\cab9e2.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\preferences~rf15d4fa.tmp
- D:\users\user\appdata\local\temp\tarbe8b.tmp
- D:\users\user\appdata\local\temp\cabb7b6.tmp
- D:\users\user\appdata\local\temp\cabb835.tmp
- D:\users\user\appdata\local\temp\tarb836.tmp
- D:\users\user\appdata\local\temp\cabb856.tmp
- D:\users\user\appdata\local\temp\tarb857.tmp
- D:\users\user\appdata\local\temp\cabb8e5.tmp
- D:\users\user\appdata\local\temp\tarb8e6.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf16a4a7.tmp
- D:\users\user\appdata\local\temp\cab6281.tmp
- D:\users\user\appdata\local\temp\cabb916.tmp
- D:\users\user\appdata\local\temp\tarbb69.tmp
- D:\users\user\appdata\local\temp\cabbb99.tmp
- D:\users\user\appdata\local\temp\tarbb9a.tmp
- D:\users\user\appdata\local\temp\cabbd50.tmp
- D:\users\user\appdata\local\temp\tarbd51.tmp
- D:\users\user\appdata\local\temp\cabbe8a.tmp
- D:\users\user\appdata\local\temp\tarb7b7.tmp
- D:\users\user\appdata\local\temp\cabbb68.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf16ce08.tmp
Moves the following files
- from D:\users\user\appdata\roaming\opera software\opera stable\extension rules\000001.dbtmp to D:\users\user\appdata\roaming\opera software\opera stable\extension rules\current
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55fa.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55f9.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55f9.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55f9.tmp~rf16557f.tmp
- from D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\ob4ovfbelafjd1nts1vf.temp to D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5aec.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5aeb.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5aeb.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5aeb.tmp~rf165aad.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5b8a.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5b3b.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5b3b.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5b3b.tmp~rf165d1d.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5e1b.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5dbc.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5dbc.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5dbc.tmp~rf165db9.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5e5b.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5e5a.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5e5a.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5e5a.tmp~rf165df7.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5e9c.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5e8b.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5e8b.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5e8b.tmp~rf165e16.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55e9.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55e8.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55e8.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55e8.tmp~rf165560.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5ebd.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5ebc.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5ebc.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5ebc.tmp~rf165e36.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf16a4a7.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\a540.tmp to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity
- from D:\users\user\appdata\roaming\opera software\opera stable\preferences to D:\users\user\appdata\roaming\opera software\opera stable\preferences~rf1692dc.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\9383.tmp to D:\users\user\appdata\roaming\opera software\opera stable\preferences
- from D:\users\user\appdata\roaming\opera software\opera stable\local state to D:\users\user\appdata\roaming\opera software\opera stable\local state~rf168aa2.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf164d54.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\8b48.tmp to D:\users\user\appdata\roaming\opera software\opera stable\local state
- from D:\users\user\appdata\roaming\opera software\opera stable\7ca7.tmp to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity
- from D:\users\user\appdata\roaming\opera software\opera stable\siteprefs.json.new to D:\users\user\appdata\roaming\opera software\opera stable\siteprefs.json
- from D:\users\user\appdata\roaming\opera software\opera stable\preferences to D:\users\user\appdata\roaming\opera software\opera stable\preferences~rf166171.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\61f3.tmp to D:\users\user\appdata\roaming\opera software\opera stable\preferences
- from D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms to D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms~rf165f20.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5ece.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5ece.tmp~rf165e55.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5ecf.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5ece.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55c6.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55c6.tmp~rf165550.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55c7.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55c6.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5364.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5364.tmp~rf165540.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\a502.tmp to D:\users\user\appdata\roaming\opera software\opera stable\local state
- from D:\users\user\appdata\roaming\opera software\opera stable\a615.tmp to D:\users\user\appdata\roaming\opera software\opera stable\preferences
- from D:\users\user\appdata\roaming\opera software\opera stable\a7ee.tmp to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity
- from D:\users\user\appdata\roaming\opera software\opera stable\b1f7.tmp to D:\users\user\appdata\roaming\opera software\opera stable\update_prefs.json
- from D:\users\user\appdata\roaming\opera software\opera stable\extension state\000001.dbtmp to D:\users\user\appdata\roaming\opera software\opera stable\extension state\current
- from D:\users\user\appdata\roaming\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000001.dbtmp to D:\users\user\appdata\roaming\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\current
- from D:\users\user\appdata\roaming\opera software\opera stable\c2ef.tmp to D:\users\user\appdata\roaming\opera software\opera stable\bookmarks
- from D:\users\user\appdata\roaming\opera software\opera stable\bookmarks to D:\users\user\appdata\roaming\opera software\opera stable\bookmarks~rf15c36d.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\d4fa.tmp to D:\users\user\appdata\roaming\opera software\opera stable\preferences
- from D:\users\user\appdata\roaming\opera software\opera stable\d4fb.tmp to D:\users\user\appdata\roaming\opera software\opera stable\local state
- from D:\users\user\appdata\roaming\opera software\opera stable\preferences to D:\users\user\appdata\roaming\opera software\opera stable\preferences~rf15d4fa.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\local state to D:\users\user\appdata\roaming\opera software\opera stable\local state~rf15d4fa.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\d73d.tmp to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity
- from D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf15d71c.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\9231.tmp to D:\users\user\appdata\roaming\opera software\opera stable\bookmarks
- from D:\users\user\appdata\roaming\opera software\opera stable\27b7.tmp to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55b6.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5364.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf16276d.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\306d.tmp to D:\users\user\appdata\roaming\opera software\opera stable\bookmarks
- from D:\users\user\appdata\roaming\opera software\opera stable\bookmarks to D:\users\user\appdata\roaming\opera software\opera stable\bookmarks~rf163072.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\3a7e.tmp to D:\users\user\appdata\roaming\opera software\opera stable\local state
- from D:\users\user\appdata\roaming\opera software\opera stable\local state to D:\users\user\appdata\roaming\opera software\opera stable\local state~rf163a22.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\4c89.tmp to D:\users\user\appdata\roaming\opera software\opera stable\bookmarksextras
- from D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf167c02.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\4dc2.tmp to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity
- from D:\users\user\appdata\roaming\opera software\opera stable\cea1.tmp to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5274.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5274.tmp~rf165206.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5296.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5295.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5295.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5295.tmp~rf165225.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\52b7.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\52a7.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\52a7.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\52a7.tmp~rf1652e0.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5275.tmp to D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5274.tmp
- from D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity to D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity~rf16ce08.tmp
Substitutes the following files
- D:\users\user\appdata\roaming\opera software\opera stable\bookmarks
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5ebc.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5e8b.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5e5a.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5dbc.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5b3b.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5aeb.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55f9.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5ece.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55e8.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5364.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\52a7.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5295.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\5274.tmp
- D:\users\user\appdata\roaming\opera software\opera stable\transportsecurity
- D:\users\user\appdata\roaming\opera software\opera stable\local state
- D:\users\user\appdata\roaming\opera software\opera stable\preferences
- D:\users\user\appdata\roaming\opera software\opera stable\jump list icons\55c6.tmp
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\de2c2917324eb806.customdestinations-ms
Network activity
Connects to
- 'au######te.geo.opera.com':80
- 'oc##.#ectigo.com':80
- 'md##z.com':443
- 'sd#.51.la':80
- 'pu##.###nzhang.baidu.com':80
- 'sd#####es.operacdn.com':443
- 'nl.##hoo.com':80
- 'tw##ter.com':80
- 'en.###ipedia.org':443
- 's.##mg.com':443
- 'bo##ing.com':80
- 'bo##ing.com':443
- 'ab#.#wimg.com':443
- 'x1.#.lencr.org':80
- 'r3.#.lencr.org':80
- 'cf.##tatic.com':443
- 'cd##########on-opera-website.operacdn.com':443
- 'cr#.###st-provider.cn':80
- 'oc##.##ust-provider.cn':80
- 'ro###.ebay.com':443
- 'ro###.ebay.com':80
- 'hm.##idu.com':443
- 'google.com':80
- 'se####.yahoo.com':80
- 'bing.com':80
- 'du###uckgo.com':443
- 'am##on.com':80
- 'se####.yahoo.com':443
- 'am##on.com':443
- 'do#####d5.operacdn.com':443
- 'tw##ter.com':443
- 'en.###ipedia.org':80
- 'si#####ck2.opera.com':80
- 'fa###ook.com':80
- 'fa###ook.com':443
- 'st####.xx.fbcdn.net':443
- 'he##123.net':80
- 'jk##d.com':443
- 'hn##fz.org':443
- 'au######te.geo.opera.com':443
- 're###.opera.com':80
- 'ap#.##are.baidu.com':80
TCP
HTTP GET requests
- http://au######te.geo.opera.com/geolocation/
- http://nl.##hoo.com/?il#####
- http://www.he##123.net/uploads/allimg/230404/11-2304040920120-L.jpg
- http://www.he##123.net/uploads/allimg/230406/11-2304061UI70-L.jpg
- http://oc##.#ectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCECpuW4oiRXEuLvigEeWgmJo%3D
- http://www.he##123.net/uploads/allimg/230407/11-23040G95Q80-L.png
- http://oc##.##ust-provider.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQDhvjmfMdSVsHZ9u52p9jqu3rd8gQUXzp8ERB%2BDGdxYdyLo7UAA2f1VxwCECCDCtqroZkPhGc4X7YGZKQ%3D
- http://www.he##123.net/uploads/allimg/230403/11-2304031K2340-L.png
- http://www.tw##ter.com/?pa################
- http://pu##.###nzhang.baidu.com/push.js
- http://re###.opera.com/speeddials/partner/product
- http://re###.opera.com/speeddials/partner/booking_com_us
- http://re###.opera.com/speeddials/partner/twitter_us
- http://re###.opera.com/speeddials/partner/yahoo
- http://www.he##123.net/templets/default/images/top_jtbx.jpg
- http://re###.opera.com/speeddials/partner/wikipedia_org_us
- http://re###.opera.com/speeddials/partner/amazon_us
- http://www.he##123.net/uploads/allimg/230403/11-2304031106010-L.png
- http://www.he##123.net/templets/default/images/wmxyxb.jpg
- http://www.he##123.net/templets/default/images/wmxy.jpg
- http://www.he##123.net/templets/default/images/wmzt.jpg
- http://www.he##123.net/templets/default/images/button_08.png
- http://www.he##123.net/templets/default/images/button_07.png
- http://www.he##123.net/templets/default/images/button_06.png
- http://www.he##123.net/templets/default/images/button_05.png
- http://www.he##123.net/templets/default/images/button_04.png
- http://www.he##123.net/templets/default/images/button_03.png
- http://www.he##123.net/templets/default/images/button_02.png
- http://www.op##a.com/follow?ut###############################################################################################
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgNL%2Fv0Uc7gwMSltgjUw374BJg%3D%3D
- http://www.he##123.net/templets/default/images/button_01.png
- http://x1.#.lencr.org/
- http://www.bo##ing.com/index.html?ai##########################################################################################
- http://sd#.51.la/js-sdk-pro.min.js
- http://re###.opera.com/speeddials/partner/youtube
- http://www.he##123.net/uploads/230411/11-2304111022551W.png
- http://www.he##123.net/templets/default/images/bg.jpg
- http://oc##.#ectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEQD8sVZeK8dAObkaltWeJkJz
- http://si#####ck2.opera.com/?ho#######################################################
- http://www.he##123.net/templets/default/css/index.css
- http://www.he##123.net/templets/default/css/basei.css
- http://www.he##123.net/templets/default/css/index67.css
- http://www.he##123.net/
- http://www.fa###ook.com/
- http://re###.opera.com/speeddials/partner/facebook
- http://si#####ck2.opera.com/?ho###################################################
- http://www.he##123.net/js.js
- http://re###.opera.com/www.opera.com/firstrun/
- http://en.###ipedia.org/favicon.ico
- http://www.am##on.com/favicon.ico
- http://www.bing.com/s/a/bing_p.ico
- http://se####.yahoo.com/favicon.ico
- http://www.google.com/favicon.ico
- http://www.he##123.net/templets/default/images/hxjzg.jpg
- http://www.he##123.net/uploads/allimg/230316/11-2303161953350-L.png
- http://www.he##123.net/templets/default/images/logo2.png
- http://www.he##123.net/templets/default/images/top_xsfz.jpg
- http://www.he##123.net/templets/default/js/js/mf-pattern/mF_kdui.css
- http://oc##.##ust-provider.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQDhvjmfMdSVsHZ9u52p9jqu3rd8gQUXzp8ERB%2BDGdxYdyLo7UAA2f1VxwCECjKecELBf%2FINYq%2FpeYN884%3D
- http://oc##.##ust-provider.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQDhvjmfMdSVsHZ9u52p9jqu3rd8gQUXzp8ERB%2BDGdxYdyLo7UAA2f1VxwCEFpmfhlG4cuEmtj1bhp1t%2Fw%3D
- http://www.he##123.net/c/fonts/1415F2_3.ttf
- http://www.he##123.net/c/fonts/1415F2_4.ttf
- http://www.he##123.net/c/fonts/1415F2_3.woff
- http://cr#.###st-provider.cn/TrustAsiaRSADVTLSCAG2.crt
- http://ro###.ebay.com/rover/1/711-53200-19255-0/1?ic###########################################################################################################################
- http://re###.opera.com/speeddials/partner/ebay_us
- http://www.he##123.net/404.html
- http://www.he##123.net/c/fonts/1415F2_4.woff
- http://www.he##123.net/templets/default/images/top_dwjl.jpg
- http://www.he##123.net/templets/default/images/top_5.jpg
- http://www.he##123.net/templets/default/images/top_kcjs.jpg
- http://www.he##123.net/templets/default/images/top_7.jpg
- http://www.he##123.net/templets/default/images/top_6.jpg
- http://ap#.##are.baidu.com/s.gif?l=#######################
Other
- 'au######te.geo.opera.com':443
- 'op##a.com':443
- 'cf.##tatic.com':443
- 'ab#.#wimg.com':443
- 'bo##ing.com':443
- 'tw##ter.com':443
- 's.##mg.com':443
- 'ya##o.com':443
- 'pa###.ebay.com':443
- 'sd#####es.operacdn.com':443
- 'md##z.com':443
- 'eb##.com':443
- 'ro###.ebay.com':443
- 'hn##fz.org':443
- 'hm.##idu.com':443
- 'jk##d.com':443
- 'st####.xx.fbcdn.net':443
- 'fa###ook.com':443
- 'en.###ipedia.org':443
- 'am##on.com':443
- 'se####.yahoo.com':443
- 'du###uckgo.com':443
- 'cd##########on-opera-website.operacdn.com':443
- 'do#####d5.operacdn.com':443
UDP
- DNS ASK k.####uogeng.com
- DNS ASK eb##.com
- DNS ASK pu##.###nzhang.baidu.com
- DNS ASK ah###ghting.com
- DNS ASK md##z.com
- DNS ASK sd#.51.la
- DNS ASK sd#####es.operacdn.com
- DNS ASK pa###.ebay.com
- DNS ASK nl.##hoo.com
- DNS ASK tw##ter.com
- DNS ASK do#####d5.operacdn.com
- DNS ASK s.##mg.com
- DNS ASK bo##ing.com
- DNS ASK ab#.#wimg.com
- DNS ASK x1.#.lencr.org
- DNS ASK r3.#.lencr.org
- DNS ASK op##a.com
- DNS ASK cf.##tatic.com
- DNS ASK cd##########on-opera-website.operacdn.com
- DNS ASK oc##.#ectigo.com
- DNS ASK ya##o.com
- DNS ASK oc##.##ust-provider.cn
- DNS ASK en.###ipedia.org
- DNS ASK k.###inming.com
- DNS ASK google.com
- DNS ASK au######te.geo.opera.com
- DNS ASK se####.yahoo.com
- DNS ASK bing.com
- DNS ASK bi##.#ikimedia.org
- DNS ASK du###uckgo.com
- DNS ASK am##on.com
- DNS ASK re###.opera.com
- DNS ASK ro###.ebay.com
- DNS ASK si#####ck2.opera.com
- DNS ASK fa###ook.com
- DNS ASK m.###ebook.com
- DNS ASK st####.xx.fbcdn.net
- DNS ASK he##123.net
- DNS ASK hn##fz.org
- DNS ASK hm.##idu.com
- DNS ASK jk##d.com
- DNS ASK cr#.###st-provider.cn
- DNS ASK ap#.##are.baidu.com
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'Opera_MessageWindow' WindowName: 'C:\Users\user\AppData\Roaming\Opera Software\Opera Stable'
Creates and executes the following
- 'D:\program files (x86)\opera\launcher.exe' -noautoupdate -- "http://www.hero123.net/"' (with hidden window)
