Overview

overview

8

Static

static

URLScan

urlscan

1

https://google.com

windows10-2004-x64

8

Resubmissions

10-01-2023 20:41

230110-zgh87she82 10

09-01-2023 13:23

230109-qmzcyahg5z 8

30-12-2022 04:52

221230-fhnqjafa36 7

29-12-2022 23:57

221229-3z3x4shg5y 8

29-12-2022 09:56

221229-lyp67afh7x 4

29-12-2022 09:28

221229-lfpspsfh5s 10

29-12-2022 04:18

221229-exfssscc88 1

29-12-2022 04:12

221229-esw9zsfd3z 8

18-12-2022 12:11

221218-pcmqqabh42 8

04-12-2022 12:48

221204-p157zaec6t 10

Analysis

  • max time kernel
    262s
  • max time network
    265s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-12-2022 04:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://google.com

Score
8/10
discoverypersistencespywarestealerupx

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 64 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 43 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://google.com
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2900
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffe4fb44f50,0x7ffe4fb44f60,0x7ffe4fb44f70
      2⤵
        PID:4372
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1680 /prefetch:2
        2⤵
          PID:1548
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2012 /prefetch:8
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2792
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2288 /prefetch:8
          2⤵
            PID:3708
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3056 /prefetch:1
            2⤵
              PID:3892
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:1
              2⤵
                PID:3664
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4324 /prefetch:8
                2⤵
                  PID:4908
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4760 /prefetch:8
                  2⤵
                    PID:4340
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2368
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4928 /prefetch:8
                    2⤵
                      PID:3544
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4780 /prefetch:8
                      2⤵
                        PID:1880
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4776 /prefetch:8
                        2⤵
                          PID:1004
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
                          2⤵
                            PID:3732
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4236
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
                            2⤵
                              PID:2352
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
                              2⤵
                                PID:1176
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4224
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
                                2⤵
                                  PID:1904
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
                                  2⤵
                                    PID:1136
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
                                    2⤵
                                      PID:4968
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
                                      2⤵
                                        PID:2244
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
                                        2⤵
                                          PID:4820
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
                                          2⤵
                                            PID:780
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3432
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
                                            2⤵
                                              PID:2016
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5848 /prefetch:8
                                              2⤵
                                                PID:2264
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5896 /prefetch:8
                                                2⤵
                                                  PID:2260
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:944
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
                                                  2⤵
                                                    PID:2416
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
                                                    2⤵
                                                      PID:516
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6300 /prefetch:8
                                                      2⤵
                                                        PID:3448
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6372 /prefetch:8
                                                        2⤵
                                                          PID:4868
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6516 /prefetch:8
                                                          2⤵
                                                            PID:4224
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6520 /prefetch:8
                                                            2⤵
                                                              PID:3576
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
                                                              2⤵
                                                                PID:4012
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
                                                                2⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:5100
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6096 /prefetch:8
                                                                2⤵
                                                                  PID:884
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5840 /prefetch:8
                                                                  2⤵
                                                                    PID:176
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
                                                                    2⤵
                                                                      PID:4060
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
                                                                      2⤵
                                                                        PID:4780
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
                                                                        2⤵
                                                                          PID:944
                                                                        • C:\Users\Admin\Downloads\ExLoader_Installer.exe
                                                                          "C:\Users\Admin\Downloads\ExLoader_Installer.exe"
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Checks computer location settings
                                                                          PID:1836
                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Drops file in Program Files directory
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:3980
                                                                            • C:\Windows\System32\cmd.exe
                                                                              C:\Windows\System32\cmd.exe /c C:\Windows\System32\reg.exe query HKEY_CURRENT_USER\Software\Yandex\YandexBrowser /v last_startup_time
                                                                              4⤵
                                                                                PID:4488
                                                                                • C:\Windows\System32\reg.exe
                                                                                  C:\Windows\System32\reg.exe query HKEY_CURRENT_USER\Software\Yandex\YandexBrowser /v last_startup_time
                                                                                  5⤵
                                                                                    PID:2524
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  C:\Windows\System32\cmd.exe /c C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Opera Software" /v "Last Stable Install Path"
                                                                                  4⤵
                                                                                    PID:2352
                                                                                    • C:\Windows\System32\reg.exe
                                                                                      C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Opera Software" /v "Last Stable Install Path"
                                                                                      5⤵
                                                                                        PID:512
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      C:\Windows\System32\cmd.exe /c C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Opera Software" /v "Last Stable Install Path"
                                                                                      4⤵
                                                                                        PID:4052
                                                                                        • C:\Windows\System32\reg.exe
                                                                                          C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Opera Software" /v "Last Stable Install Path"
                                                                                          5⤵
                                                                                            PID:2132
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          C:\Windows\System32\cmd.exe /c C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Opera Software" /v "Last Stable Install Path"
                                                                                          4⤵
                                                                                            PID:3892
                                                                                            • C:\Windows\System32\reg.exe
                                                                                              C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Opera Software" /v "Last Stable Install Path"
                                                                                              5⤵
                                                                                                PID:4992
                                                                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -command C:\Windows\System32\tasklist.exe /FI "\"IMAGENAME" eq "exloader.exe\"" /FO CSV
                                                                                              4⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:4720
                                                                                              • C:\Windows\System32\tasklist.exe
                                                                                                "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq exloader.exe" /FO CSV
                                                                                                5⤵
                                                                                                • Enumerates processes with tasklist
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2812
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              C:\Windows\System32\cmd.exe /c C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
                                                                                              4⤵
                                                                                                PID:824
                                                                                                • C:\Windows\System32\reg.exe
                                                                                                  C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
                                                                                                  5⤵
                                                                                                    PID:3260
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  C:\Windows\System32\cmd.exe /c C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
                                                                                                  4⤵
                                                                                                    PID:1156
                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                      C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
                                                                                                      5⤵
                                                                                                        PID:2380
                                                                                                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -command "$WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"c:\users\admin\desktop\ExLoader.lnk\") $Shortcut.TargetPath = \"C:\Program Files\ExLoader\ExLoader.exe\" $Shortcut.Save()"
                                                                                                      4⤵
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:4488
                                                                                                    • C:\Program Files\ExLoader\ExLoader.exe
                                                                                                      "C:\Program Files\ExLoader\ExLoader.exe" -deletePreviousExLoader
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:1992
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography /v MachineGuid
                                                                                                        5⤵
                                                                                                          PID:2088
                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                            C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography /v MachineGuid
                                                                                                            6⤵
                                                                                                              PID:4076
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                            5⤵
                                                                                                              PID:2236
                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                6⤵
                                                                                                                  PID:512
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Valve\Steam /v InstallPath
                                                                                                                5⤵
                                                                                                                  PID:3092
                                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                                    C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Valve\Steam /v InstallPath
                                                                                                                    6⤵
                                                                                                                      PID:2216
                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                    C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\Valve\Steam /v InstallPath
                                                                                                                    5⤵
                                                                                                                      PID:2648
                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                        C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\Valve\Steam /v InstallPath
                                                                                                                        6⤵
                                                                                                                          PID:4388
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query HKEY_CURRENT_USER\SOFTWARE\Valve\Steam /v SteamPath
                                                                                                                        5⤵
                                                                                                                          PID:5076
                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                            C:\Windows\System32\reg.exe query HKEY_CURRENT_USER\SOFTWARE\Valve\Steam /v SteamPath
                                                                                                                            6⤵
                                                                                                                              PID:4724
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Steam /v UninstallString
                                                                                                                            5⤵
                                                                                                                              PID:1768
                                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                                C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Steam /v UninstallString
                                                                                                                                6⤵
                                                                                                                                  PID:216
                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Steam /v UninstallString
                                                                                                                                5⤵
                                                                                                                                  PID:1140
                                                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                                                    C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Steam /v UninstallString
                                                                                                                                    6⤵
                                                                                                                                      PID:1420
                                                                                                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -command C:\Windows\System32\tasklist.exe /FI "\"IMAGENAME" eq "steam.exe\"" /FO CSV
                                                                                                                                    5⤵
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:4036
                                                                                                                                    • C:\Windows\System32\tasklist.exe
                                                                                                                                      "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq steam.exe" /FO CSV
                                                                                                                                      6⤵
                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:4520
                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                  C:\Windows\System32\cmd.exe /c C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallDate
                                                                                                                                  4⤵
                                                                                                                                    PID:2212
                                                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                                                      C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallDate
                                                                                                                                      5⤵
                                                                                                                                        PID:1896
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      C:\Windows\System32\cmd.exe /c C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
                                                                                                                                      4⤵
                                                                                                                                        PID:4808
                                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                                          C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
                                                                                                                                          5⤵
                                                                                                                                            PID:824
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe --silent --allusers=0
                                                                                                                                          4⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • Enumerates connected drives
                                                                                                                                          • Modifies system certificate store
                                                                                                                                          PID:4012
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x340,0x344,0x348,0x31c,0x34c,0x73858658,0x73858668,0x73858674
                                                                                                                                            5⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            PID:4256
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe" --version
                                                                                                                                            5⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            PID:3924
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=4012 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20221229051456" --session-guid=95972635-02bb-481c-8eb8-4a4c3b591f9f --server-tracking-blob="ZWExMWJiOTk0NmVlZDk2MGYwYjBhNGFlOTBiZDcwZjUwMmI4MWYxOTM0MjMxZDQwYTdkYjgwMjhjNjQ1OTJiMzp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGU/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1PRlQmdXRtX2NhbXBhaWduPU9MRF9fMTgyMjZhIiwidGltZXN0YW1wIjoiMTY3MjI4NzI5My4zMzA2IiwidXNlcmFnZW50IjoiRGFydC8yLjE4IChkYXJ0OmlvKSIsInV0bSI6eyJjYW1wYWlnbiI6Ik9MRF9fMTgyMjZhIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiT0ZUIn0sInV1aWQiOiIxZDdjMWNiMC1mMTk3LTQ2ZjQtYWYwZS1hZWFlMTUwODYzMTgifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=D005000000000000
                                                                                                                                            5⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Enumerates connected drives
                                                                                                                                            PID:3880
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x34c,0x350,0x354,0x31c,0x358,0x74f88658,0x74f88668,0x74f88674
                                                                                                                                              6⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              PID:4436
                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\installer.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\installer.exe" --backend --initial-pid=4012 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212290514561" --session-guid=95972635-02bb-481c-8eb8-4a4c3b591f9f --server-tracking-blob="ZWExMWJiOTk0NmVlZDk2MGYwYjBhNGFlOTBiZDcwZjUwMmI4MWYxOTM0MjMxZDQwYTdkYjgwMjhjNjQ1OTJiMzp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGU/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1PRlQmdXRtX2NhbXBhaWduPU9MRF9fMTgyMjZhIiwidGltZXN0YW1wIjoiMTY3MjI4NzI5My4zMzA2IiwidXNlcmFnZW50IjoiRGFydC8yLjE4IChkYXJ0OmlvKSIsInV0bSI6eyJjYW1wYWlnbiI6Ik9MRF9fMTgyMjZhIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiT0ZUIn0sInV1aWQiOiIxZDdjMWNiMC1mMTk3LTQ2ZjQtYWYwZS1hZWFlMTUwODYzMTgifQ== " --silent --desktopshortcut=1 --install-subfolder=94.0.4606.38
                                                                                                                                              6⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Registers COM server for autorun
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Enumerates connected drives
                                                                                                                                              • Modifies registry class
                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:1180
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\installer.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x2a8,0x2ac,0x2b0,0x27c,0x280,0x7ffe4eaf2c98,0x7ffe4eaf2ca8,0x7ffe4eaf2cb8
                                                                                                                                                7⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:2328
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212290514561\assistant\assistant_installer.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212290514561\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=0
                                                                                                                                                7⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Adds Run key to start application
                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                PID:4908
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212290514561\assistant\assistant_installer.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212290514561\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x2fc,0xee2dc0,0xee2dd0,0xee2ddc
                                                                                                                                                  8⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:640
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --start-maximized
                                                                                                                                                7⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:2568
                                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher
                                                                                                                                                  8⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                  PID:1232
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_crashreporter.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x7ffe449ea490,0x7ffe449ea4a0,0x7ffe449ea4b0
                                                                                                                                                    9⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:1080
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1940,i,8522151435740416213,11920547146981063273,131072 /prefetch:2
                                                                                                                                                    9⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:5108
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=2100 --field-trial-handle=1940,i,8522151435740416213,11920547146981063273,131072 /prefetch:8
                                                                                                                                                    9⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:2512
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212290514561\assistant\_sfx.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212290514561\assistant\_sfx.exe"
                                                                                                                                            5⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:3148
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212290514561\assistant\assistant_installer.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212290514561\assistant\assistant_installer.exe" --version
                                                                                                                                            5⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:4264
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212290514561\assistant\assistant_installer.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212290514561\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x2fc,0xee2dc0,0xee2dd0,0xee2ddc
                                                                                                                                              6⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1140
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7036 /prefetch:8
                                                                                                                                      2⤵
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      PID:2648
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:8
                                                                                                                                      2⤵
                                                                                                                                        PID:1380
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
                                                                                                                                        2⤵
                                                                                                                                          PID:1896
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                            PID:4988
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5896 /prefetch:8
                                                                                                                                            2⤵
                                                                                                                                              PID:2620
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1
                                                                                                                                              2⤵
                                                                                                                                                PID:2028
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5888 /prefetch:8
                                                                                                                                                2⤵
                                                                                                                                                  PID:612
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5308 /prefetch:8
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2492
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
                                                                                                                                                    2⤵
                                                                                                                                                      PID:2812
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6968 /prefetch:2
                                                                                                                                                      2⤵
                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                      PID:2752
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
                                                                                                                                                      2⤵
                                                                                                                                                        PID:2352
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15625124065535510930,1529164260930653289,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2816 /prefetch:1
                                                                                                                                                        2⤵
                                                                                                                                                          PID:2984
                                                                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2508
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=0
                                                                                                                                                          1⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:4500
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0xf52dc0,0xf52dd0,0xf52ddc
                                                                                                                                                            2⤵
                                                                                                                                                              PID:2760
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:444
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
                                                                                                                                                                3⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4924
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x2d8,0x2dc,0x2e0,0x2b4,0x2e4,0xff23f8,0xff2408,0xff2414
                                                                                                                                                                3⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:1956
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:4532
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:3468
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:4140
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
                                                                                                                                                                3⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5448
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher --flag-switches-begin --flag-switches-end --enable-quic --lowered-browser
                                                                                                                                                            1⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:1628
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_crashreporter.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x7ffe449ea490,0x7ffe449ea4a0,0x7ffe449ea4b0
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:4296
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:2
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:1544
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=2284 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:1392
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=1976 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:456
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=3032 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:2760
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=3044 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:448
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=3056 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:748
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=3068 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:4848
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=3084 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:4124
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=3096 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:3452
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --mojo-platform-channel-handle=3448 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:3276
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=3464 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:2184
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --mojo-platform-channel-handle=4516 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:5504
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --mojo-platform-channel-handle=4544 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:5532
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --mojo-platform-channel-handle=4584 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:5544
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4592 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:5576
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4952 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              PID:5696
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=5220 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              PID:5784
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" --pipeid=oauc_pipe2906202b27b41e4bd66c9238c4b575c1
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:6052
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff7f3b49b38,0x7ff7f3b49b48,0x7ff7f3b49b58
                                                                                                                                                                3⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:6064
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=5576 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:2312
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=4380 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              PID:2752
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=5932 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:3312
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=6028 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              PID:3732
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5928 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              PID:1384
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=6652 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              PID:5352
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=6648 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              PID:5392
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6696 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:1556
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6588 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:1548
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6752 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:4460
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6592 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                                PID:3596
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6736 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:5452
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6764 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:3548
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6776 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:5044
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6856 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:884
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6876 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:5380
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6928 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:3256
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6848 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:4100
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6936 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:3508
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6908 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:1952
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6900 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:3172
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6892 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:3928
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=7020 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:5136
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=7028 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:5648
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6964 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1256
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6960 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:5164
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6932 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:5880
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=7040 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1904
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --mojo-platform-channel-handle=6888 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:1
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                  PID:5240
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=7064 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:716
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=4396 --field-trial-handle=1924,i,12952513590516952526,14825282792916171820,131072 /prefetch:8
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:6204
                                                                                                                                                                                                  • C:\Windows\system32\wbem\unsecapp.exe
                                                                                                                                                                                                    C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:6004
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate --autoupdaterequesttype=automatic --autoupdateoperaversion=94.0.4606.38 --newautoupdaterlogic
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:6040
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:1304
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe" --pipeid=oauc_task_pipedcbb8f53eff625f232ff45d764476217 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015" --scheduledtask
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:2284
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\Crash Reports" --crash-count-file=C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\crash_count.txt --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff7f3b49b38,0x7ff7f3b49b48,0x7ff7f3b49b58
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:2648

                                                                                                                                                                                                    Network

                                                                                                                                                                                                    MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                    Execution

                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                    2
                                                                                                                                                                                                    T1060

                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                                    3
                                                                                                                                                                                                    T1112

                                                                                                                                                                                                    Install Root Certificate

                                                                                                                                                                                                    1
                                                                                                                                                                                                    T1130

                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                    Credentials in Files

                                                                                                                                                                                                    1
                                                                                                                                                                                                    T1081

                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                    Query Registry

                                                                                                                                                                                                    4
                                                                                                                                                                                                    T1012

                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                    4
                                                                                                                                                                                                    T1082

                                                                                                                                                                                                    Peripheral Device Discovery

                                                                                                                                                                                                    1
                                                                                                                                                                                                    T1120

                                                                                                                                                                                                    Process Discovery

                                                                                                                                                                                                    1
                                                                                                                                                                                                    T1057

                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                    Collection

                                                                                                                                                                                                    Data from Local System

                                                                                                                                                                                                    1
                                                                                                                                                                                                    T1005

                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                    Impact

                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      99KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      7fa893507dbcf67c9d0ccb99a95b68d2

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      19f73a80f4ab72a22d6b2f0e3ce1b49c69b256d0

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      868053582adec7f8d9270a4408074df3137c953944269bb757024a6214493269

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      3108701d8a715e5be1148b64bf915fddf3890b75cc020d6fae5cf65b71dc08a424c197c24bfb2cf7f361c1c129989eddb651033c4ee27783f1d35f0f671f0f1e

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      99KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      7fa893507dbcf67c9d0ccb99a95b68d2

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      19f73a80f4ab72a22d6b2f0e3ce1b49c69b256d0

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      868053582adec7f8d9270a4408074df3137c953944269bb757024a6214493269

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      3108701d8a715e5be1148b64bf915fddf3890b75cc020d6fae5cf65b71dc08a424c197c24bfb2cf7f361c1c129989eddb651033c4ee27783f1d35f0f671f0f1e

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\MSVCP140.dll
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      558KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      bf78c15068d6671693dfcdfa5770d705

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      4418c03c3161706a4349dfe3f97278e7a5d8962a

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\VCRUNTIME140.dll
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      94KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      11d9ac94e8cb17bd23dea89f8e757f18

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      d4fb80a512486821ad320c4fd67abcae63005158

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\VCRUNTIME140_1.dll
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      36KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      7667b0883de4667ec87c3b75bed84d84

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      e6f6df83e813ed8252614a46a5892c4856df1f58

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\app.so
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.8MB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      ebb4a8e07085b2a67d669e37bec44e98

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      fe21912a2c24cdb7a270046b88a8f2c15e32e2d6

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      66a87219bebd28d2b88b6c26228867774a0dc7d0f3f10d8828fe0382b9167c79

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      4175ddac17454420c152996506bfb6699717c95146365fc726f0580661ffb04630b06623a9a37d225a133c60b415c8acdff68020dbf177f4d397a0f9f2a0414c

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\FontManifest.json
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      394B

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      d5db5124c8470ef3d02e3fcb7536a234

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      1b26ca91230fc342c6afb08dc0601eb8533e77b8

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      ce82969b8c44f1f7750c9646d4ffdd1c99d6abb99565deb102dfb37c2c541de6

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      8ff3d4786ebc2fe85f9035d85da58ea8953de129fa448b32b4c19eae8d3eb9bcce30399801e6762f6484a0b6d4d5c023d06c5b1ec4e13eddfe131ce9b9561641

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\MONTSERRAT-BOLD.TTF
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      255KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      88932dadc42e1bba93b21a76de60ef7a

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      3320ff5514b32565b0396de4f2064ce17ec9eea4

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      c4c8cb572a5a2c43d78b3701f4b2349684e6ca4d1557e469af6065b1e099c26c

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      298e1e171dbbe386e1abe153446b883c40910819099f64f54dc9faa95d739be56839537342bbe8dd8408545cb1f8c98878a3524d91af1f11a112d1bfc202657a

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\MONTSERRAT-MEDIUM.TTF
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      254KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      a98626e1aef6ceba5dfc1ee7112e235a

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      ca42fe10fa893f390472859405c7564095e4260f

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      92b3d3c6e135eb1dc95f88e6ca75bd6113d9eb3261a95ca39f733e3897e53675

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      81761cd87aece3cea03b4520d8c7518f8d549d8e91cce2a4a4752729e7a28ad4b502472731a06f7051f357bfa1042640a5e7592887b1c3914de0dfe230ef882c

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\MONTSERRAT-SEMIBOLD.TTF
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      254KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      c88cecbffad6d8e731fd95de49561ebd

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      4ef29a9163b56df34a3486b98b24be3a3d0cdca6

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      bab583d38d105dac9141b287fb2b7763b6d8b0bae97e745faaccedb40a579c29

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      d514f33af50e74906617f8a9bb91e91f11a3ad3387f262c78804252df284e860d9d61d0bb4a61b60f122a00749824957bf53e8c308d7a53b722e7b88777c791d

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\icons\close.svg
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      299B

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      48136cdde28ef3bd42836d10a06b43fb

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      623781c566c4cf19d0139b8036ce3bb5b076aa85

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      4209cfea7eadb13b87a41dd79083b20aff8830ac3701d85eba9d939dc5b57af3

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      ba16dafcab39d4fa8c0295e0f4707284a0f8c90333ee5b6135fd2ddd76f9a9920c40e5cbb730a1cb5a809228d6dbf6f5ad797d9d1e2c783dcea066bbb2a23c55

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\icons\maximize.svg
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      330B

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      776c137f6b6fc0161cccef9229adf74f

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      b15b53f6c286d9325995cede4b022689b44c0d8e

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      641f30c10af5e892fff394eb39c2d4905ab7851e3146262ca9d6fa8f09163ea5

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      b4188e1fd182db4689b6b1aa32d9aa51b882396d49b662df41e1d3d8507c2087fa10136c29c5ec6671e88628fdfba42ebc90c2913f591dd66c7509e24e5d833b

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\icons\minimize.svg
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      230B

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      5da2dfbd12c9aacdb03ce0d6dc414a8d

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      9eccc4092745b13f051d90273af78a6f64a21348

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      60a44cb1aecc5a3b6ed5b4224ce83ca001ec42fe22e33b0eccb183b74bb9b4a4

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      e7d906f34258bed095aa1358c2dbf575f22ffb8d77e57391e23477801939b0907c927373fe4cc99ebdd30ba5be0adaadad76fbdbc6060788d7869c9047b2049f

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\icudtl.dat
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      796KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      dc1d7fbeacfb517e801dcb886074ed42

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      ab969ca7aace910f9c906d5ed7473a79caccafc5

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      b00f83f6938d2ec735ac8f970c779f8ff28063b91a73d022b7a954bb85231c38

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      085815b511544f531effffc46b0ed5cde5834d4c85497487fa5cbd8e7b3dbfef597b63c47c92b5512a1f80e7924ea41ba797c3b90d2818d34630a7f5f0bc3161

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\flutter_windows.dll
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      15.1MB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      ad39134489085f1983c0cbf801df7a5a

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      d35d2408ee6449aaf3b8ce338dbba5e31107dda8

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      76ba47ebf660de9c9271e3a9881c14c592559377a765d5e43ef19924c83c5524

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      09bc769f77f2c7a193505a741c16f2ac991830ecea67ea8f20efd008d44ab8b1c1fa029a6d5154dffa2f338d9fd0a7a7e68d69ef4f0ac38576c046fe75c91fe7

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\flutter_windows.dll
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      15.1MB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      ad39134489085f1983c0cbf801df7a5a

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      d35d2408ee6449aaf3b8ce338dbba5e31107dda8

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      76ba47ebf660de9c9271e3a9881c14c592559377a765d5e43ef19924c83c5524

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      09bc769f77f2c7a193505a741c16f2ac991830ecea67ea8f20efd008d44ab8b1c1fa029a6d5154dffa2f338d9fd0a7a7e68d69ef4f0ac38576c046fe75c91fe7

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\msvcp140.dll
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      558KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      bf78c15068d6671693dfcdfa5770d705

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      4418c03c3161706a4349dfe3f97278e7a5d8962a

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\vcruntime140.dll
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      94KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      11d9ac94e8cb17bd23dea89f8e757f18

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      d4fb80a512486821ad320c4fd67abcae63005158

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\vcruntime140_1.dll
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      36KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      7667b0883de4667ec87c3b75bed84d84

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      e6f6df83e813ed8252614a46a5892c4856df1f58

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\Downloads\ExLoader_Installer.exe
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.1MB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      a916526ecd6e27b56eace0d3598d0c3c

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      0d39441ac93a76d12dd9c5b695291ae082c294f1

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      760d4123c2982416a6a81171c75b68c391453169f8703826d932cc66f189b2f0

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      e8a9fa0f37a5a7ace8e69feedf9bf493b00477b004bbc78d70b8f5727a27dd1d6f0e3bead6f4b512f198ce919843b26c0514bcccf526c5bbf357029361955b01

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • C:\Users\Admin\Downloads\ExLoader_Installer.exe
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.1MB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      a916526ecd6e27b56eace0d3598d0c3c

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      0d39441ac93a76d12dd9c5b695291ae082c294f1

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      760d4123c2982416a6a81171c75b68c391453169f8703826d932cc66f189b2f0

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      e8a9fa0f37a5a7ace8e69feedf9bf493b00477b004bbc78d70b8f5727a27dd1d6f0e3bead6f4b512f198ce919843b26c0514bcccf526c5bbf357029361955b01

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • \??\pipe\crashpad_2900_TKJJJMTLECCHJTKG
                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                      Download Submit
                                                                                                                                                                                                    • memory/216-216-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/444-228-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/456-242-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/512-194-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/512-165-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/640-226-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/824-174-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/824-189-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/1080-235-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/1140-217-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/1140-208-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/1156-176-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/1180-223-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/1232-234-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/1420-218-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/1544-241-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/1768-215-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/1836-134-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/1896-183-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/1956-230-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/1992-185-0x000001AB213F0000-0x000001AB22105000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      13.1MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/1992-187-0x000001AB213F0000-0x000001AB22105000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      13.1MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/1992-186-0x000001AB213F0000-0x000001AB22105000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      13.1MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/1992-181-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/2088-191-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/2132-167-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/2212-182-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/2216-210-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/2236-193-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/2328-224-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/2352-164-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/2380-177-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/2512-238-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/2524-163-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/2568-232-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/2648-211-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/2760-227-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/2812-172-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/3092-209-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/3148-205-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/3260-175-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/3468-233-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/3880-207-0x0000000000400000-0x000000000090C000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.0MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/3880-202-0x0000000000400000-0x000000000090C000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.0MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/3880-254-0x0000000000400000-0x000000000090C000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.0MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/3880-201-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/3892-168-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/3924-197-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/3924-200-0x0000000000400000-0x000000000090C000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.0MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/3980-137-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/3980-149-0x000002684A2D0000-0x000002684A8A1000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.8MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/3980-150-0x000002684A2D0000-0x000002684A8A1000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.8MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/3980-151-0x000002684A2D0000-0x000002684A8A1000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.8MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4012-198-0x0000000000400000-0x000000000090C000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.0MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4012-256-0x0000000000400000-0x000000000090C000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.0MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4012-195-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4036-219-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4036-222-0x00007FFE4B1B0000-0x00007FFE4BC71000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4036-220-0x00007FFE4B1B0000-0x00007FFE4BC71000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4052-166-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4076-192-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4256-196-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4256-257-0x0000000000400000-0x000000000090C000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.0MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4256-199-0x0000000000400000-0x000000000090C000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.0MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4264-206-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4296-239-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4388-212-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4436-204-0x0000000000400000-0x000000000090C000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.0MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4436-255-0x0000000000400000-0x000000000090C000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.0MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4436-203-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4488-179-0x00007FFE49EF0000-0x00007FFE4A9B1000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4488-178-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4488-162-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4520-221-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4532-231-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4720-170-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4720-171-0x0000013DD8EF0000-0x0000013DD8F12000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      136KB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4720-173-0x00007FFE49EF0000-0x00007FFE4A9B1000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4720-180-0x00007FFE49EF0000-0x00007FFE4A9B1000-memory.dmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4724-214-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4808-184-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4908-225-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4924-229-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/4992-169-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/5076-213-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download
                                                                                                                                                                                                    • memory/5108-237-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      Download