Technical Information
- '%WINDIR%\explorer.exe' /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
- '%WINDIR%\explorer.exe' /s , "http://www.he##123.net/"
- <APATH_ALLOC_DIR>\0AC4_01A20000_19.ndmp
- <APATH_ALLOC_DIR>\0AC4_01700000_18.ndmp
- <APATH_ALLOC_DIR>\0AC4_00700000_17.ndmp
- <APATH_ALLOC_DIR>\0AC4_01B10000_20.ndmp
- <APATH_ALLOC_DIR>\0AC4_01DB0000_23.ndmp
- <APATH_ALLOC_DIR>\0AC4_01C50000_22.ndmp
- <APATH_ALLOC_DIR>\0AC4_01B50000_21.ndmp
- <APATH_ALLOC_DIR>\0AC4_00600000_16.ndmp
- <APATH_ALLOC_DIR>\0AC4_00330000_11.ndmp
- <APATH_ALLOC_DIR>\0AC4_00320000_10.ndmp
- <APATH_ALLOC_DIR>\0AC4_00250000_9.ndmp
- <APATH_ALLOC_DIR>\0AC4_00370000_12.ndmp
- <APATH_ALLOC_DIR>\0AC4_00520000_15.ndmp
- <APATH_ALLOC_DIR>\0AC4_00410000_14.ndmp
- <APATH_ALLOC_DIR>\0AC4_00380000_13.ndmp
- <APATH_ALLOC_DIR>\0AC4_7FFDE000_34.ndmp
- <APATH_ALLOC_DIR>\0AC4_7FFDD000_33.ndmp
- <APATH_ALLOC_DIR>\0AC4_7FFDC000_32.ndmp
- <APATH_ALLOC_DIR>\0AC4_7FFDF000_35.ndmp
- %TEMP%\etilqs_chRbpP9cQfUSDgf
- %TEMP%\etilqs_IHeD0ngmf8UqvdB
- <APATH_ALLOC_DIR>\0AC4_7FFE0000_36.ndmp
- <APATH_ALLOC_DIR>\0AC4_7FFDB000_31.ndmp
- <APATH_ALLOC_DIR>\0AC4_01FF0000_26.ndmp
- <APATH_ALLOC_DIR>\0AC4_01EF0000_25.ndmp
- <APATH_ALLOC_DIR>\0AC4_01DF0000_24.ndmp
- <APATH_ALLOC_DIR>\0AC4_77990000_27.ndmp
- <APATH_ALLOC_DIR>\0AC4_7FFD3000_30.ndmp
- <APATH_ALLOC_DIR>\0AC4_7FFB0000_29.ndmp
- <APATH_ALLOC_DIR>\0AC4_7F6F0000_28.ndmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\127E.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\10E6.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\FFA.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1389.tmp
- %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8BHMEQWWJS1HWOWAMKQV.temp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1503.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1436.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D69.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
- %TEMP%\etilqs_MWjZpqaZJThbTLD
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
- <APATH_ALLOC_DIR>\0AC4_00140000_4.ndmp
- <APATH_ALLOC_DIR>\0AC4_00130000_3.ndmp
- <APATH_ALLOC_DIR>\0AC4_00030000_2.ndmp
- <APATH_ALLOC_DIR>\0AC4_00150000_5.ndmp
- <APATH_ALLOC_DIR>\0AC4_00240000_8.ndmp
- <APATH_ALLOC_DIR>\0AC4_001D0000_7.ndmp
- <APATH_ALLOC_DIR>\0AC4_001C0000_6.ndmp
- <APATH_ALLOC_DIR>\0AC4_00020000_1.ndmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
- <APATH_ALLOC_DIR>\0AC4_00010000_0.ndmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\2192.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1407.tmp~RFc14d7.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1369.tmp~RFc13ed.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\14F3.tmp~RFc1554.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFc1757.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1154.tmp~RFc1351.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFbfb8d.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D58.tmp~RFc0f99.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\10D5.tmp~RFc1100.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\FE9.tmp~RFc1035.TMP
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1407.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1407.tmp~RFc14d7.TMP
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1503.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\14F3.tmp
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1436.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1407.tmp
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1389.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1369.tmp
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1369.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1369.tmp~RFc13ed.TMP
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\14F3.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\14F3.tmp~RFc1554.TMP
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT to %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFc1757.TMP
- from %APPDATA%\Roaming\Opera Software\Opera Stable\2192.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
- from %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8BHMEQWWJS1HWOWAMKQV.temp to %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D69.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D58.tmp
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D58.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D58.tmp~RFc0f99.TMP
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT to %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFbfb8d.TMP
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\FFA.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\FE9.tmp
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\127E.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1154.tmp
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1154.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1154.tmp~RFc1351.TMP
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\10D5.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\10D5.tmp~RFc1100.TMP
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\FE9.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\FE9.tmp~RFc1035.TMP
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\10E6.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\10D5.tmp
- DNS ASK bi##.#ikimedia.org
- DNS ASK ap#.###sys.opera.com
- DNS ASK dn#.##ftncsi.com
- DNS ASK sl####i.yandex.ru
- DNS ASK au######te.geo.opera.com
- DNS ASK en.###ipedia.org
- DNS ASK re###.opera.com
- DNS ASK k.###inming.com
- DNS ASK www.ic#.com
- DNS ASK www.google.com
- DNS ASK k.####uogeng.com
- DNS ASK www.he##123.net
- DNS ASK i.##0.ru
- DNS ASK www.go##le.ru
- DNS ASK si#####ck2.opera.com
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Roaming\Opera Software\Opera Stable'