Trojan.DownLoader22.31384

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\DLSProvider] 'ImagePath' = '<SYSTEM32>\dls.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\DLSProvider] 'Start' = '00000002'

Malicious functions:

Executes the following:

'%TEMP%\7ZipSfx.000\opera.exe' /install
'%TEMP%\Setup44fd.exe'
'<SYSTEM32>\dls.exe'

Modifies file system:

Creates the following files:

%TEMP%\7ZipSfx.000\locale\es-LA\es-LA.lng
%TEMP%\7ZipSfx.000\locale\et\et.lng
%TEMP%\7ZipSfx.000\locale\es-ES\es-ES.lng
%TEMP%\7ZipSfx.000\locale\en-GB\en-GB.lng
%TEMP%\7ZipSfx.000\locale\en\en.lng
%TEMP%\7ZipSfx.000\locale\fy\fy.lng
%TEMP%\7ZipSfx.000\locale\gd\gd.lng
%TEMP%\7ZipSfx.000\locale\fr\fr.lng
%TEMP%\7ZipSfx.000\locale\fi\fi.lng
%TEMP%\7ZipSfx.000\locale\fr-CA\fr-CA.lng
%TEMP%\7ZipSfx.000\locale\be\be.lng
%TEMP%\7ZipSfx.000\locale\bg\bg.lng
%TEMP%\7ZipSfx.000\locale\az\az.lng
%TEMP%\7ZipSfx.000\mathml.dtd
%TEMP%\7ZipSfx.000\locale\af\af.lng
%TEMP%\7ZipSfx.000\locale\de\de.lng
%TEMP%\7ZipSfx.000\locale\el\el.lng
%TEMP%\7ZipSfx.000\locale\da\da.lng
%TEMP%\7ZipSfx.000\locale\bn\bn.lng
%TEMP%\7ZipSfx.000\locale\cs\cs.lng
%TEMP%\7ZipSfx.000\locale\hi\hi.lng
%TEMP%\7ZipSfx.000\locale\nn\nn.lng
%TEMP%\7ZipSfx.000\locale\pa\pa.lng
%TEMP%\7ZipSfx.000\locale\nl\nl.lng
%TEMP%\7ZipSfx.000\locale\ms\ms.lng
%TEMP%\7ZipSfx.000\locale\nb\nb.lng
%TEMP%\7ZipSfx.000\locale\ro\ro.lng
%TEMP%\7ZipSfx.000\locale\ru\ru.lng
%TEMP%\7ZipSfx.000\locale\pt\pt.lng
%TEMP%\7ZipSfx.000\locale\pl\pl.lng
%TEMP%\7ZipSfx.000\locale\pt-BR\pt-BR.lng
%TEMP%\7ZipSfx.000\locale\it\it.lng
%TEMP%\7ZipSfx.000\locale\ja\ja.lng
%TEMP%\7ZipSfx.000\locale\id\id.lng
%TEMP%\7ZipSfx.000\locale\hr\hr.lng
%TEMP%\7ZipSfx.000\locale\hu\hu.lng
%TEMP%\7ZipSfx.000\locale\me\me.lng
%TEMP%\7ZipSfx.000\locale\mk\mk.lng
%TEMP%\7ZipSfx.000\locale\lt\lt.lng
%TEMP%\7ZipSfx.000\locale\ka\ka.lng
%TEMP%\7ZipSfx.000\locale\ko\ko.lng
%TEMP%\7ZipSfx.000\html40_entities.dtd
%TEMP%\7ZipSfx.000\locale\sk\bookmarks.adr
%TEMP%\7ZipSfx.000\region\middle_east\bookmarks.adr
%TEMP%\7ZipSfx.000\locale\ro\bookmarks.adr
%TEMP%\7ZipSfx.000\locale\bg\bookmarks.adr
%TEMP%\7ZipSfx.000\locale\sr\bookmarks.adr
%TEMP%\7ZipSfx.000\locale\cs\bookmarks.adr
%TEMP%\7ZipSfx.000\locale\tr\bookmarks.adr
%TEMP%\7ZipSfx.000\locale\be\bookmarks.adr
%TEMP%\7ZipSfx.000\locale\zh-cn\bookmarks.adr
%TEMP%\7ZipSfx.000\locale\hu\bookmarks.adr
%TEMP%\7ZipSfx.000\ui\standard_toolbar.ini
%TEMP%\7ZipSfx.000\defaults\standard_trusted_repositories.ini
%TEMP%\7ZipSfx.000\defaults\standard_speeddial.ini
%TEMP%\7ZipSfx.000\region\middle_east\standard_speeddial.ini
%TEMP%\7ZipSfx.000\region\latin_america\standard_speeddial.ini
%TEMP%\7ZipSfx.000\defaults\xmlentities.ini
%TEMP%\7ZipSfx.000\region\cn\en\bookmarks.adr
%TEMP%\7ZipSfx.000\defaults\webmailproviders.ini
%TEMP%\7ZipSfx.000\ui\standard_voice.ini
%TEMP%\7ZipSfx.000\defaults\tips_metadata.ini
%TEMP%\7ZipSfx.000\region\cis\en\bookmarks.adr
%TEMP%\7ZipSfx.000\locale\ru\bookmarks.adr
%TEMP%\7ZipSfx.000\region\cis\ru\bookmarks.adr
%TEMP%\7ZipSfx.000\region\gb\bookmarks.adr
%TEMP%\7ZipSfx.000\locale\pt-BR\bookmarks.adr
%TEMP%\7ZipSfx.000\locale\pl\bookmarks.adr
%TEMP%\7ZipSfx.000\html5_entity_init.dat
%TEMP%\7ZipSfx.000\defaults\public_domains.dat
%TEMP%\7ZipSfx.000\locale\ja\bookmarks.adr
%TEMP%\7ZipSfx.000\locale\de\bookmarks.adr
%TEMP%\7ZipSfx.000\region\in\bookmarks.adr
%TEMP%\7ZipSfx.000\region\id\bookmarks.adr
%TEMP%\7ZipSfx.000\locale\nb\bookmarks.adr
%TEMP%\7ZipSfx.000\locale\it\bookmarks.adr
%TEMP%\7ZipSfx.000\locale\uk\bookmarks.adr
%TEMP%\7ZipSfx.000\locale\es-ES\bookmarks.adr
%TEMP%\7ZipSfx.000\locale\fr\bookmarks.adr
%TEMP%\7ZipSfx.000\region\ua\ru\bookmarks.adr
%TEMP%\7ZipSfx.000\defaults\bookmarks.adr
%TEMP%\7ZipSfx.000\region\us\bookmarks.adr
%TEMP%\7ZipSfx.000\region\latin_america\bookmarks.adr
%TEMP%\7ZipSfx.000\profile\styles\user\disablepositioning.css
%TEMP%\7ZipSfx.000\profile\styles\user\disabletables.css
%TEMP%\7ZipSfx.000\profile\styles\user\disableforms.css
%TEMP%\7ZipSfx.000\profile\styles\user\disablebreaks.css
%TEMP%\7ZipSfx.000\profile\styles\user\disablefloats.css
%TEMP%\7ZipSfx.000\profile\styles\user\structuretables.css
%TEMP%\7ZipSfx.000\profile\styles\user\tablelayout.css
%TEMP%\7ZipSfx.000\profile\styles\user\structureinline.css
%TEMP%\7ZipSfx.000\profile\styles\user\outline.css
%TEMP%\7ZipSfx.000\profile\styles\user\structureblock.css
%TEMP%\7ZipSfx.000\profile\opr1.tmp
%TEMP%\7ZipSfx.000\profile\bookmarks.adr
%TEMP%\7ZipSfx.000\opera.dll
%TEMP%\7ZipSfx.000\gstreamer\plugins\gstwavparse.dll
%TEMP%\7ZipSfx.000\gstreamer\plugins\gstwebmdec.dll
%TEMP%\7ZipSfx.000\profile\styles\user\contrastbw.css
%TEMP%\7ZipSfx.000\profile\styles\user\contrastwb.css
%TEMP%\7ZipSfx.000\profile\styles\user\classid.css
%TEMP%\7ZipSfx.000\profile\styles\user\accessibility.css
%TEMP%\7ZipSfx.000\profile\styles\user\altdebugger.css
%TEMP%\7ZipSfx.000\profile\styles\user\toc.css
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
%APPDATA%\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
%TEMP%\7ZipSfx.000\profile\opr8.tmp
%TEMP%\7ZipSfx.000\profile\opr6.tmp
%TEMP%\7ZipSfx.000\profile\opr7.tmp
%TEMP%\7ZipSfx.000\profile\cache\sesn\opr00001.tmp
%TEMP%\6c76bc96-b0bb-1a4b-963c-f04c8e4c26c1.xml
%TEMP%\7ZipSfx.000\profile\optrb.dat
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\0797C381B2F87EB5A1D5573BD15BA4F4
%APPDATA%\Microsoft\CryptnetUrlCache\Content\0797C381B2F87EB5A1D5573BD15BA4F4
%TEMP%\7ZipSfx.000\profile\vps\0000\wb.vx
%TEMP%\7ZipSfx.000\profile\vps\0000\md.dat
%TEMP%\7ZipSfx.000\profile\vps\0000\w.axx
%TEMP%\7ZipSfx.000\profile\opr2.tmp
%TEMP%\7ZipSfx.000\profile\cache\CACHEDIR.TAG
%TEMP%\7ZipSfx.000\profile\opr4.tmp
%TEMP%\7ZipSfx.000\profile\opr5.tmp
%TEMP%\7ZipSfx.000\profile\opr3.tmp
%TEMP%\7ZipSfx.000\profile\vps\0000\adoc.bx
%TEMP%\7ZipSfx.000\profile\vps\0000\url.axx
%TEMP%\7ZipSfx.000\gstreamer\plugins\gstwaveform.dll
%TEMP%\7ZipSfx.000\locale\zh-tw\zh-tw.lng
%TEMP%\7ZipSfx.000\locale\zu\zu.lng
%TEMP%\7ZipSfx.000\locale\zh-cn\zh-cn.lng
%TEMP%\7ZipSfx.000\locale\uz\uz.lng
%TEMP%\7ZipSfx.000\locale\vi\vi.lng
%TEMP%\7ZipSfx.000\files_old.sig
%TEMP%\7ZipSfx.000\unite\fileSharing.ua
%TEMP%\7ZipSfx.000\files.sig
%TEMP%\7ZipSfx.000\styles\m2_upgrade_1160.mbs
%TEMP%\7ZipSfx.000\styles\m2_welcome_message.mbs
%TEMP%\7ZipSfx.000\locale\sw\sw.lng
%TEMP%\7ZipSfx.000\locale\ta\ta.lng
%TEMP%\7ZipSfx.000\locale\sv\sv.lng
%TEMP%\7ZipSfx.000\locale\sk\sk.lng
%TEMP%\7ZipSfx.000\locale\sr\sr.lng
%TEMP%\7ZipSfx.000\locale\tr\tr.lng
%TEMP%\7ZipSfx.000\locale\uk\uk.lng
%TEMP%\7ZipSfx.000\locale\tl\tl.lng
%TEMP%\7ZipSfx.000\locale\te\te.lng
%TEMP%\7ZipSfx.000\locale\th\th.lng
%TEMP%\7ZipSfx.000\unite\fridge.ua
%TEMP%\7ZipSfx.000\gstreamer\plugins\gstcoreplugins.dll
%TEMP%\7ZipSfx.000\gstreamer\plugins\gstdecodebin2.dll
%TEMP%\7ZipSfx.000\gstreamer\plugins\gstautodetect.dll
%TEMP%\7ZipSfx.000\gstreamer\plugins\gstaudioconvert.dll
%TEMP%\7ZipSfx.000\gstreamer\plugins\gstaudioresample.dll
%TEMP%\7ZipSfx.000\gstreamer\gstreamer.dll
%TEMP%\7ZipSfx.000\gstreamer\plugins\gsttypefindfunctions.dll
%TEMP%\7ZipSfx.000\gstreamer\plugins\gstoggdec.dll
%TEMP%\7ZipSfx.000\gstreamer\plugins\gstdirectsound.dll
%TEMP%\7ZipSfx.000\gstreamer\plugins\gstffmpegcolorspace.dll
%TEMP%\7ZipSfx.000\unite\photoSharing.ua
%TEMP%\7ZipSfx.000\unite\webserver.ua
%TEMP%\7ZipSfx.000\unite\messenger.ua
%TEMP%\7ZipSfx.000\unite\home.ua
%TEMP%\7ZipSfx.000\unite\mediaPlayer.ua
%TEMP%\7ZipSfx.000\program\netscape.exe
%TEMP%\7ZipSfx.000\opera.exe
%TEMP%\7ZipSfx.000\ui\widgets.yaml
%TEMP%\7ZipSfx.000\c3nform.vxml
%TEMP%\7ZipSfx.000\ui\dialogs.yaml
%TEMP%\7ZipSfx.000\styles\dir.css
%TEMP%\7ZipSfx.000\styles\user\disablebreaks.css
%TEMP%\7ZipSfx.000\styles\debug.css
%TEMP%\7ZipSfx.000\styles\user\contrastbw.css
%TEMP%\7ZipSfx.000\styles\user\contrastwb.css
%TEMP%\7ZipSfx.000\styles\user\disabletables.css
%TEMP%\7ZipSfx.000\styles\drives.css
%TEMP%\7ZipSfx.000\styles\user\disablepositioning.css
%TEMP%\7ZipSfx.000\styles\user\disablefloats.css
%TEMP%\7ZipSfx.000\styles\user\disableforms.css
%TEMP%\7ZipSfx.000\styles\user\accessibility.css
%TEMP%\7ZipSfx.000\styles\user\altdebugger.css
%TEMP%\7ZipSfx.000\styles\about.css
%TEMP%\7ZipSfx.000\region\tw\turbosettings.xml
%TEMP%\7ZipSfx.000\styles\webfeeds.html
%TEMP%\7ZipSfx.000\styles\config.css
%TEMP%\7ZipSfx.000\styles\contentblock.css
%TEMP%\7ZipSfx.000\styles\user\classid.css
%TEMP%\7ZipSfx.000\styles\cache.css
%TEMP%\7ZipSfx.000\styles\certinfo.css
%TEMP%\7ZipSfx.000\styles\error.css
%TEMP%\7ZipSfx.000\styles\private.css
%TEMP%\7ZipSfx.000\styles\search.css
%TEMP%\7ZipSfx.000\styles\plugins.css
%TEMP%\7ZipSfx.000\styles\opera.css
%TEMP%\7ZipSfx.000\styles\user\outline.css
%TEMP%\7ZipSfx.000\styles\user\tablelayout.css
%TEMP%\7ZipSfx.000\styles\user\toc.css
%TEMP%\7ZipSfx.000\styles\user\structuretables.css
%TEMP%\7ZipSfx.000\styles\user\structureblock.css
%TEMP%\7ZipSfx.000\styles\user\structureinline.css
%TEMP%\7ZipSfx.000\styles\image.css
%TEMP%\7ZipSfx.000\styles\info.css
%TEMP%\7ZipSfx.000\styles\im.css
%TEMP%\7ZipSfx.000\styles\feed.css
%TEMP%\7ZipSfx.000\styles\history.css
%TEMP%\7ZipSfx.000\styles\message.css
%TEMP%\7ZipSfx.000\styles\mime.css
%TEMP%\7ZipSfx.000\styles\media.css
%TEMP%\7ZipSfx.000\styles\mail.css
%TEMP%\7ZipSfx.000\styles\mathml.css
%TEMP%\7ZipSfx.000\region\hk\turbosettings.xml
%TEMP%\7ZipSfx.000\styles\images\darkBox.png
%TEMP%\7ZipSfx.000\styles\images\defaultFavicon.png
%TEMP%\7ZipSfx.000\styles\images\container.png
%TEMP%\7ZipSfx.000\styles\images\bullet.png
%TEMP%\7ZipSfx.000\styles\images\center.png
%TEMP%\7ZipSfx.000\styles\images\folder.png
%TEMP%\7ZipSfx.000\styles\images\hanger.png
%TEMP%\7ZipSfx.000\styles\images\flag.png
%TEMP%\7ZipSfx.000\styles\images\error.png
%TEMP%\7ZipSfx.000\styles\images\file.png
%TEMP%\7ZipSfx.000\locale\en\en.zip
%TEMP%\7ZipSfx.000\skin\standard_skin.zip
%TEMP%\7ZipSfx.000\files_list
<SYSTEM32>\dls.exe
%TEMP%\Setup44fd.exe
%TEMP%\7ZipSfx.000\styles\images\bkgd-rev.png
%TEMP%\7ZipSfx.000\styles\images\bkgd.png
%TEMP%\7ZipSfx.000\styles\images\bar.png
%TEMP%\7ZipSfx.000\styles\images\customize.gif
%TEMP%\7ZipSfx.000\styles\images\arrow.png
%TEMP%\7ZipSfx.000\styles\images\opera-icon-red.png
%TEMP%\7ZipSfx.000\extra\missingplugin.svg
%TEMP%\7ZipSfx.000\extra\missingpluginhover.svg
%TEMP%\7ZipSfx.000\styles\images\warning.png
%TEMP%\7ZipSfx.000\styles\images\tooltiptail.png
%TEMP%\7ZipSfx.000\styles\images\top.png
%TEMP%\7ZipSfx.000\pubsuffix.xml
%TEMP%\7ZipSfx.000\region\cn\turbosettings.xml
%TEMP%\7ZipSfx.000\defaults\mailproviders.xml
%TEMP%\7ZipSfx.000\encoding.bin
%TEMP%\7ZipSfx.000\defaults\dictionaries.xml
%TEMP%\7ZipSfx.000\styles\images\red_center.png
%TEMP%\7ZipSfx.000\styles\images\red_left.png
%TEMP%\7ZipSfx.000\styles\images\page-bot.png
%TEMP%\7ZipSfx.000\styles\images\opera.png
%TEMP%\7ZipSfx.000\styles\images\Opera_256x256.png
%TEMP%\7ZipSfx.000\styles\images\section.png
%TEMP%\7ZipSfx.000\styles\images\smartGroup.png
%TEMP%\7ZipSfx.000\styles\images\search.png
%TEMP%\7ZipSfx.000\styles\images\red_right.png
%TEMP%\7ZipSfx.000\styles\images\root.png
%TEMP%\7ZipSfx.000\ui\standard_mouse.ini
%TEMP%\7ZipSfx.000\locale\sr\standard_speeddial.ini
%TEMP%\7ZipSfx.000\ui\standard_menu.ini
%TEMP%\7ZipSfx.000\ui\standard_keyboard.ini
%TEMP%\7ZipSfx.000\ui\standard_keyboard_compat.ini
%TEMP%\7ZipSfx.000\locale\fr\standard_speeddial.ini
%TEMP%\7ZipSfx.000\locale\ja\standard_speeddial.ini
%TEMP%\7ZipSfx.000\locale\hu\standard_speeddial.ini
%TEMP%\7ZipSfx.000\locale\bg\standard_speeddial.ini
%TEMP%\7ZipSfx.000\locale\es-ES\standard_speeddial.ini
%TEMP%\7ZipSfx.000\region\gb\search.ini
%TEMP%\7ZipSfx.000\locale\ja\search.ini
%TEMP%\7ZipSfx.000\region\us\search.ini
%TEMP%\7ZipSfx.000\locale\zh-cn\search.ini
%TEMP%\7ZipSfx.000\region\cis\en\search.ini
%TEMP%\7ZipSfx.000\locale\ru\search.ini
%TEMP%\7ZipSfx.000\region\cis\ru\search.ini
%TEMP%\7ZipSfx.000\locale\uk\search.ini
%TEMP%\7ZipSfx.000\locale\cs\search.ini
%TEMP%\7ZipSfx.000\region\ua\ru\search.ini
%TEMP%\7ZipSfx.000\locale\ro\standard_speeddial.ini
%TEMP%\7ZipSfx.000\region\cis\en\standard_speeddial.ini
%TEMP%\7ZipSfx.000\region\ua\ru\standard_speeddial.ini
%TEMP%\7ZipSfx.000\locale\uk\standard_speeddial.ini
%TEMP%\7ZipSfx.000\locale\sk\standard_speeddial.ini
%TEMP%\7ZipSfx.000\locale\de\standard_speeddial.ini
%TEMP%\7ZipSfx.000\region\in\standard_speeddial.ini
%TEMP%\7ZipSfx.000\locale\pt-BR\standard_speeddial.ini
%TEMP%\7ZipSfx.000\region\us\standard_speeddial.ini
%TEMP%\7ZipSfx.000\locale\nb\standard_speeddial.ini
%TEMP%\7ZipSfx.000\region\id\standard_speeddial.ini
%TEMP%\7ZipSfx.000\region\cn\en\standard_speeddial.ini
%TEMP%\7ZipSfx.000\locale\zh-cn\standard_speeddial.ini
%TEMP%\7ZipSfx.000\locale\tr\standard_speeddial.ini
%TEMP%\7ZipSfx.000\region\gb\standard_speeddial.ini
%TEMP%\7ZipSfx.000\locale\it\standard_speeddial.ini
%TEMP%\7ZipSfx.000\locale\pl\standard_speeddial.ini
%TEMP%\7ZipSfx.000\locale\cs\standard_speeddial.ini
%TEMP%\7ZipSfx.000\locale\be\standard_speeddial.ini
%TEMP%\7ZipSfx.000\locale\ru\standard_speeddial.ini
%TEMP%\7ZipSfx.000\region\cis\ru\standard_speeddial.ini
%TEMP%\7ZipSfx.000\locale\pl\search.ini
%TEMP%\7ZipSfx.000\ui\dialog.ini
%TEMP%\7ZipSfx.000\ui\embedded_keyboard.ini
%TEMP%\7ZipSfx.000\gstreamer\README.txt
%TEMP%\7ZipSfx.000\lngcode.txt
%TEMP%\7ZipSfx.000\program\plugins\readme.txt
%TEMP%\7ZipSfx.000\defaults\feedreaders.ini
%TEMP%\7ZipSfx.000\defaults\handlers-ignore.ini
%TEMP%\7ZipSfx.000\ui\fastforward.ini
%TEMP%\7ZipSfx.000\ui\embedded_menu.ini
%TEMP%\7ZipSfx.000\ui\embedded_mouse.ini
%TEMP%\7ZipSfx.000\styles\wml.css
%TEMP%\7ZipSfx.000\region\cn\browser.js
%TEMP%\7ZipSfx.000\styles\webstorage.css
%TEMP%\7ZipSfx.000\styles\unstyledxml.css
%TEMP%\7ZipSfx.000\styles\warning.css
%TEMP%\7ZipSfx.000\defaults\license.txt
%TEMP%\7ZipSfx.000\locale\en\license.txt
%TEMP%\7ZipSfx.000\gstreamer\LGPL.txt
%TEMP%\7ZipSfx.000\region\hk\browser.js
%TEMP%\7ZipSfx.000\region\tw\browser.js
%TEMP%\7ZipSfx.000\defaults\plugin-ignore.ini
%TEMP%\7ZipSfx.000\locale\de\search.ini
%TEMP%\7ZipSfx.000\locale\tr\search.ini
%TEMP%\7ZipSfx.000\locale\it\search.ini
%TEMP%\7ZipSfx.000\locale\es-ES\search.ini
%TEMP%\7ZipSfx.000\locale\fr\search.ini
%TEMP%\7ZipSfx.000\locale\sk\search.ini
%TEMP%\7ZipSfx.000\region\cn\en\search.ini
%TEMP%\7ZipSfx.000\locale\nb\search.ini
%TEMP%\7ZipSfx.000\locale\be\search.ini
%TEMP%\7ZipSfx.000\defaults\search.ini
%TEMP%\7ZipSfx.000\locale\pt-BR\search.ini
%TEMP%\7ZipSfx.000\region\in\search.ini
%TEMP%\7ZipSfx.000\region\latin_america\search.ini
%TEMP%\7ZipSfx.000\region\region.ini
%TEMP%\7ZipSfx.000\region\middle_east\search.ini
%TEMP%\7ZipSfx.000\region\id\search.ini
%TEMP%\7ZipSfx.000\locale\hu\search.ini
%TEMP%\7ZipSfx.000\locale\sr\search.ini
%TEMP%\7ZipSfx.000\locale\bg\search.ini
%TEMP%\7ZipSfx.000\locale\ro\search.ini

Deletes the following files:

%TEMP%\7ZipSfx.000\profile\cache\sesn\opr00001.tmp

Moves the following files:

from %TEMP%\7ZipSfx.000\profile\opr6.tmp to %TEMP%\7ZipSfx.000\profile\operaprefs.ini
from %TEMP%\7ZipSfx.000\profile\opr5.tmp to %TEMP%\7ZipSfx.000\profile\operaprefs.ini
from %TEMP%\7ZipSfx.000\profile\opr8.tmp to %TEMP%\7ZipSfx.000\profile\operaprefs.ini
from %TEMP%\7ZipSfx.000\profile\opr7.tmp to %TEMP%\7ZipSfx.000\profile\operaprefs.ini
from %TEMP%\7ZipSfx.000\profile\opr2.tmp to %TEMP%\7ZipSfx.000\profile\operaprefs.ini
from %TEMP%\7ZipSfx.000\profile\opr1.tmp to %TEMP%\7ZipSfx.000\profile\operaprefs.ini
from %TEMP%\7ZipSfx.000\profile\opr4.tmp to %TEMP%\7ZipSfx.000\profile\operaprefs.ini
from %TEMP%\7ZipSfx.000\profile\opr3.tmp to %TEMP%\7ZipSfx.000\profile\operaprefs.ini

Network activity:

Connects to:

'cs#######-2-crl.verisign.com':80
'au#####ate.opera.com':80
'wp#d':80
'crl.verisign.com':80

TCP:

HTTP GET requests:

http://cs#######-2-crl.verisign.com/CSC3-2009-2.crl
http://crl.verisign.com/pca3.crl
http://11#.#11.111.2/wpad.dat via wp#d

HTTP POST requests:

http://au#####ate.opera.com/

UDP:

DNS ASK crl.verisign.com
DNS ASK cs#######-2-crl.verisign.com
DNS ASK au#####ate.opera.com
DNS ASK wp#d

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial