Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

TLauncher-....1.exe

windows10-1703-x64

8

Analysis

  • max time kernel
    600s
  • max time network
    601s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    30/12/2022, 02:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TLauncher-2.86-Installer-1.0.1.exe

  • Size

    21.7MB

  • MD5

    f643be370cc9763a17f7746b1b6a0243

  • SHA1

    c65391f59a6e1421d783eaf43eb9661cfd476f82

  • SHA256

    5ab5f39d143b6ff77df2fd5026ac8e4788edfd3de27a4e1fa4b420a7d2f61d38

  • SHA512

    5ce377dc1a4a59723cf2b969c0cadb3197e5bf61d0064e2e8c94a0be9d4fd1cd9b33e05078a17e89f54b763e180be32ce14b46949a58ff47e5df18183291142f

  • SSDEEP

    393216:WXYwVCtYto0fs/dQETVlOBbpFEj9GZdqV56HpkbGCST7yuk9sLx:WowVCWTHExiTTqqHpMsV

Score
8/10
discoverypersistencespywarestealerupx

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 64 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 18 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 45 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of SetWindowsHookEx 33 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1908426 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe" "__IRCT:3" "__IRTSS:22693301" "__IRSID:S-1-5-21-3844063266-715245855-4050956231-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:3308
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3304
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1814730 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1839152" "__IRSID:S-1-5-21-3844063266-715245855-4050956231-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:4868
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            PID:3816
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x2fc,0x300,0x304,0x2d8,0x308,0x6ed68658,0x6ed68668,0x6ed68674
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4256
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:812
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3816 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20221230035558" --session-guid=b31ebf0b-cc0b-4a78-9290-aa86ee3e7b6b --server-tracking-blob=NDNkYjYzZTEyNDAxMjA2ZGM3MmVlNGM5MDBhZDEwNDAwMDZiZGIwOTIzODJkNzlhYTIwYmVhYTQwOTdmN2U3YTp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzIzNjg5NTMuMzMyNiIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiODRjODMwOGUtN2NjMC00NjA5LWI3YmQtOTA3NTExZTg2NGUxIn0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0C05000000000000
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Suspicious use of SetWindowsHookEx
              PID:4868
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x308,0x30c,0x310,0x2d8,0x314,0x6e1f8658,0x6e1f8668,0x6e1f8674
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:2084
              • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\installer.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\installer.exe" --backend --initial-pid=3816 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212300355581" --session-guid=b31ebf0b-cc0b-4a78-9290-aa86ee3e7b6b --server-tracking-blob=NDNkYjYzZTEyNDAxMjA2ZGM3MmVlNGM5MDBhZDEwNDAwMDZiZGIwOTIzODJkNzlhYTIwYmVhYTQwOTdmN2U3YTp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzIzNjg5NTMuMzMyNiIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiODRjODMwOGUtN2NjMC00NjA5LWI3YmQtOTA3NTExZTg2NGUxIn0= --silent --desktopshortcut=1 --install-subfolder=94.0.4606.38
                7⤵
                • Executes dropped EXE
                • Registers COM server for autorun
                • Checks computer location settings
                • Loads dropped DLL
                • Enumerates connected drives
                • Modifies registry class
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SetWindowsHookEx
                PID:4940
                • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\installer.exe
                  C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ffc9c4b2c98,0x7ffc9c4b2ca8,0x7ffc9c4b2cb8
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:1212
                • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\installer_helper_64.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\installer_helper_64.exe" 1 "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212300355581\Opera Browser.lnk"
                  8⤵
                    PID:3516
                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212300355581\assistant\assistant_installer.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212300355581\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=0
                    8⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Modifies Internet Explorer settings
                    • Suspicious use of SetWindowsHookEx
                    PID:4704
                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212300355581\assistant\assistant_installer.exe
                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212300355581\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x15c2dc0,0x15c2dd0,0x15c2ddc
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1484
                  • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --start-maximized
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4376
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher
                      9⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      PID:4164
                      • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_crashreporter.exe
                        C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ffc8a50a490,0x7ffc8a50a4a0,0x7ffc8a50a4b0
                        10⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:4044
                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1512 --field-trial-handle=1856,i,10046642466669205330,1798749696969845136,131072 /prefetch:2
                        10⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetWindowsHookEx
                        PID:2596
                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=1784 --field-trial-handle=1856,i,10046642466669205330,1798749696969845136,131072 /prefetch:8
                        10⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetWindowsHookEx
                        PID:4460
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212300355581\assistant\_sfx.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212300355581\assistant\_sfx.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4324
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212300355581\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212300355581\assistant\assistant_installer.exe" --version
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1548
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212300355581\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212300355581\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x15c2dc0,0x15c2dd0,0x15c2ddc
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1196
        • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
          "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1772
          • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
            "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
            4⤵
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            PID:1476
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4896
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffcac304f50,0x7ffcac304f60,0x7ffcac304f70
        2⤵
          PID:4000
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1668 /prefetch:8
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4796
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2284 /prefetch:8
          2⤵
            PID:2276
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1620 /prefetch:2
            2⤵
              PID:2288
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2720 /prefetch:1
              2⤵
                PID:4592
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2584 /prefetch:1
                2⤵
                  PID:4528
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
                  2⤵
                    PID:4640
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4240 /prefetch:8
                    2⤵
                      PID:4628
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4400 /prefetch:8
                      2⤵
                        PID:1160
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4544 /prefetch:8
                        2⤵
                          PID:1628
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:792
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5136 /prefetch:8
                          2⤵
                            PID:2208
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3836
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5236 /prefetch:8
                            2⤵
                              PID:3496
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4728 /prefetch:8
                              2⤵
                                PID:3704
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5212 /prefetch:8
                                2⤵
                                  PID:3344
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
                                  2⤵
                                    PID:344
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4692 /prefetch:8
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3404
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4424 /prefetch:8
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1452
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3476 /prefetch:8
                                    2⤵
                                      PID:3244
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4500 /prefetch:8
                                      2⤵
                                        PID:4636
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=956 /prefetch:8
                                        2⤵
                                          PID:3240
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5204 /prefetch:8
                                          2⤵
                                            PID:4064
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4472 /prefetch:8
                                            2⤵
                                              PID:1968
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4784 /prefetch:8
                                              2⤵
                                                PID:4060
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5208 /prefetch:8
                                                2⤵
                                                  PID:1076
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 /prefetch:8
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1892
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4364 /prefetch:1
                                                  2⤵
                                                    PID:3792
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:1
                                                    2⤵
                                                      PID:4160
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
                                                      2⤵
                                                        PID:2040
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
                                                        2⤵
                                                          PID:1956
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
                                                          2⤵
                                                            PID:4428
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
                                                            2⤵
                                                              PID:3828
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
                                                              2⤵
                                                                PID:4040
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
                                                                2⤵
                                                                  PID:736
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
                                                                  2⤵
                                                                    PID:2376
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
                                                                    2⤵
                                                                      PID:2580
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
                                                                      2⤵
                                                                        PID:1628
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
                                                                        2⤵
                                                                          PID:616
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2624 /prefetch:1
                                                                          2⤵
                                                                            PID:1056
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6528 /prefetch:8
                                                                            2⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:216
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
                                                                            2⤵
                                                                              PID:1452
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
                                                                              2⤵
                                                                                PID:3972
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
                                                                                2⤵
                                                                                  PID:4272
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7148 /prefetch:8
                                                                                  2⤵
                                                                                    PID:1384
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7432 /prefetch:8
                                                                                    2⤵
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:1412
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7324 /prefetch:1
                                                                                    2⤵
                                                                                      PID:4460
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
                                                                                      2⤵
                                                                                        PID:4864
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
                                                                                        2⤵
                                                                                          PID:1932
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2496 /prefetch:8
                                                                                          2⤵
                                                                                            PID:4852
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1704 /prefetch:2
                                                                                            2⤵
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:5804
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7348 /prefetch:1
                                                                                            2⤵
                                                                                              PID:6920
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:1
                                                                                              2⤵
                                                                                                PID:6968
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1416 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:7080
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:6924
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:6684
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:5408
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:7048
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:6252
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1416 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:6692
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:6496
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:6428
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:6752
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:6884
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2076 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:4864
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1044 /prefetch:8
                                                                                                                        2⤵
                                                                                                                          PID:6560
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:4404
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:4624
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:4472
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6640 /prefetch:8
                                                                                                                                2⤵
                                                                                                                                  PID:6952
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4680 /prefetch:8
                                                                                                                                  2⤵
                                                                                                                                    PID:4940
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4876 /prefetch:8
                                                                                                                                    2⤵
                                                                                                                                      PID:3508
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1420 /prefetch:8
                                                                                                                                      2⤵
                                                                                                                                        PID:7020
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8197078926948353657,48010362954450488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4732 /prefetch:8
                                                                                                                                        2⤵
                                                                                                                                          PID:3588
                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=0
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:5060
                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x1132dc0,0x1132dd0,0x1132ddc
                                                                                                                                          2⤵
                                                                                                                                            PID:5088
                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"
                                                                                                                                            2⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                            PID:5220
                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
                                                                                                                                              3⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5548
                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x10d23f8,0x10d2408,0x10d2414
                                                                                                                                              3⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5652
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
                                                                                                                                                4⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:5996
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
                                                                                                                                                4⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:5144
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
                                                                                                                                                4⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:5980
                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
                                                                                                                                              3⤵
                                                                                                                                                PID:5732
                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher --flag-switches-begin --flag-switches-end --enable-quic --lowered-browser
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Checks computer location settings
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Adds Run key to start application
                                                                                                                                            • Checks processor information in registry
                                                                                                                                            • Enumerates system info in registry
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:5400
                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_crashreporter.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x7ffc8a50a490,0x7ffc8a50a4a0,0x7ffc8a50a4b0
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5448
                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:2
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              PID:5720
                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=1748 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              PID:5760
                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=2132 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              PID:5780
                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=2664 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              PID:5832
                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=2676 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              PID:5928
                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=2688 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              PID:6028
                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=2700 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              PID:6104
                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=2712 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                              2⤵
                                                                                                                                                PID:5140
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=2724 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:5228
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --mojo-platform-channel-handle=2980 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:5236
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=2988 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:5284
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --mojo-platform-channel-handle=4216 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:5388
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --mojo-platform-channel-handle=4256 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:1720
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --mojo-platform-channel-handle=4284 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:5880
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4300 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:4040
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4508 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:4608
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=4820 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:5304
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=5000 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:5040
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" --pipeid=oauc_pipe2906202b27b41e4bd66c9238c4b575c1
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:4688
                                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6380e9b38,0x7ff6380e9b48,0x7ff6380e9b58
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:2168
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=5060 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Checks computer location settings
                                                                                                                                                PID:1144
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=5388 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Modifies registry class
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:3516
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5940 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Checks computer location settings
                                                                                                                                                PID:704
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=6156 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Checks computer location settings
                                                                                                                                                PID:4744
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=6316 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Checks computer location settings
                                                                                                                                                PID:5364
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=5464 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Checks computer location settings
                                                                                                                                                PID:5312
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6424 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:5140
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=4996 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:5732
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6388 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:1412
                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6372 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                2⤵
                                                                                                                                                  PID:1564
                                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=5088 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                  2⤵
                                                                                                                                                    PID:6228
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6296 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                    2⤵
                                                                                                                                                      PID:6308
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=5404 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                      2⤵
                                                                                                                                                        PID:6324
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6444 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                        2⤵
                                                                                                                                                          PID:6352
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6448 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                          2⤵
                                                                                                                                                            PID:6400
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6460 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                            2⤵
                                                                                                                                                              PID:6460
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6476 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                                PID:6500
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6488 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:6540
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6520 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:6600
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6532 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:6684
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6544 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:6740
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6548 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:6768
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --mojo-platform-channel-handle=6568 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:1
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                          PID:6812
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6688 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:6876
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6684 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:6944
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6736 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:6996
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6732 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:7028
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6680 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:7092
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=3348 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:7148
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=3600 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:4864
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6496 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:5736
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6624 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:6520
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=7304 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:6036
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=8788 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1408
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=7320 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:6484
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=8296 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:6704
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=8396 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:5152
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=7432 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:6724
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6420 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:6796
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=9096 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:6804
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --mojo-platform-channel-handle=8976 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:1
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            PID:6440
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=9080 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:6500
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=6988 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:6244
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=8084 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:6396
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=8176 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:6456
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=1204 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:6712
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=3704 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:6264
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=748 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:8
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:6032
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:in-house-autocomplete-send=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6592 --field-trial-handle=1872,i,16474955934944719667,16904924681110124669,131072 /prefetch:2
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                          PID:7012
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate --autoupdaterequesttype=automatic --autoupdateoperaversion=94.0.4606.38 --newautoupdaterlogic
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:5532
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:1488
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe" --pipeid=oauc_task_pipedcbb8f53eff625f232ff45d764476217 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015" --scheduledtask
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:6432
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\Crash Reports" --crash-count-file=C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\crash_count.txt --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6380e9b38,0x7ff6380e9b48,0x7ff6380e9b58
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:6832
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:6740
                                                                                                                                                                                                                            • C:\Windows\system32\wbem\unsecapp.exe
                                                                                                                                                                                                                              C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:5088

                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              086dc2b60c0c9549928b422925f8da1f

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              6b49bf506400001384cc6aede5bc02ce524f1ee3

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              961ece59d55214b4c9c0216d40403203e630d3cb871667a4ea500b66dab65417

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              49a4e5f9d05c3bb88f22faa28b7c57fb59eb528218d5dd9b75de77baa04e365db11254d90414276a98acfdc2820013964f5970e7e06d214be058169e8712396a

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              471B

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              8a6b6876c999f8f8381fd43c0b92683b

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              5e35aec46878ed185f27610b628ebc0e36f36dbc

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              a330d911de34a1430a49dce5d2a12d83a6f6c55479f21b0170220b2dc52a04de

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              2d48aff7f704a2b7e66895da898bdf08930d3667150fcf7b6eebd0c0abc27c92e98340d68d78a351a3f08d4c7ebf349b447b551bdcb13a31be940835fe76b929

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              438B

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b4118af92d160b3585cf40bfddef4334

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              c63329b37cc1ab1116d82179f9ae2c78b3421066

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              1c3169a1e9f65a14b29baec4874094d284b763a5007ecd5aed120cb2bc1e98da

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              8d4cf40fa86f6349c0730f2a0ae25fe35128712508cc1d499053607252947f3a7091b9e53befbdd5aa9d9a5ff02856914feb1e7829dc278cef7ddc1244e1c7c3

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              434B

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              aec33439620a28e52be4b81fa4cd6098

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7621c7ed440bd426d62a46ca42f4ec14240f4535

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              4acd7231b4c34f433b22c021a80285cd18757d8d5d6c183560701e97c21dd3e9

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              b275a6a83b49dab9f3f16ab134dec87cff6c7e04961dd773551231a74ae51eead6eee4fb4322950f0aa8c1c65178a74ba92d1ee5dad154722098c94e479a7351

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.7MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              f46f1fd729d297aeb3f6f596b1435991

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              92754a59bc9142b949cf5bcdd016ef70cc19a32a

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              d5e243a62ca20b7b2640e67da9bca5ad1444c8417bfaa28b629bf3db0674e311

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              c7384226bbdf013cb67ecb627958f896e74c28a921c8f54106d04e8ebd6a14ac8b48621333e682598068c217fed1b4cbba93f0cb34c9d3819402bfdae4d2bacf

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.7MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              f46f1fd729d297aeb3f6f596b1435991

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              92754a59bc9142b949cf5bcdd016ef70cc19a32a

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              d5e243a62ca20b7b2640e67da9bca5ad1444c8417bfaa28b629bf3db0674e311

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              c7384226bbdf013cb67ecb627958f896e74c28a921c8f54106d04e8ebd6a14ac8b48621333e682598068c217fed1b4cbba93f0cb34c9d3819402bfdae4d2bacf

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              f8996d2158a69a12b4bc99edd28100bc

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              892887691df881fe432e09b618e90f50447340e6

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              f8996d2158a69a12b4bc99edd28100bc

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              892887691df881fe432e09b618e90f50447340e6

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              1313bb5df6c6e0d5c358735044fbebef

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              cac3e2e3ed63dc147318e18f202a9da849830a91

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              1313bb5df6c6e0d5c358735044fbebef

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              cac3e2e3ed63dc147318e18f202a9da849830a91

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              326KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              80d93d38badecdd2b134fe4699721223

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              e7bbc7b426cee4b8027a00b11f06ef34

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              926fad387ede328d3cfd9da80d0b303a865cca98

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              e7bbc7b426cee4b8027a00b11f06ef34

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              926fad387ede328d3cfd9da80d0b303a865cca98

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              326KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              80d93d38badecdd2b134fe4699721223

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.7MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              f46f1fd729d297aeb3f6f596b1435991

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              92754a59bc9142b949cf5bcdd016ef70cc19a32a

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              d5e243a62ca20b7b2640e67da9bca5ad1444c8417bfaa28b629bf3db0674e311

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              c7384226bbdf013cb67ecb627958f896e74c28a921c8f54106d04e8ebd6a14ac8b48621333e682598068c217fed1b4cbba93f0cb34c9d3819402bfdae4d2bacf

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.7MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              f46f1fd729d297aeb3f6f596b1435991

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              92754a59bc9142b949cf5bcdd016ef70cc19a32a

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              d5e243a62ca20b7b2640e67da9bca5ad1444c8417bfaa28b629bf3db0674e311

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              c7384226bbdf013cb67ecb627958f896e74c28a921c8f54106d04e8ebd6a14ac8b48621333e682598068c217fed1b4cbba93f0cb34c9d3819402bfdae4d2bacf

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.7MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              f46f1fd729d297aeb3f6f596b1435991

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              92754a59bc9142b949cf5bcdd016ef70cc19a32a

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              d5e243a62ca20b7b2640e67da9bca5ad1444c8417bfaa28b629bf3db0674e311

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              c7384226bbdf013cb67ecb627958f896e74c28a921c8f54106d04e8ebd6a14ac8b48621333e682598068c217fed1b4cbba93f0cb34c9d3819402bfdae4d2bacf

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.7MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              f46f1fd729d297aeb3f6f596b1435991

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              92754a59bc9142b949cf5bcdd016ef70cc19a32a

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              d5e243a62ca20b7b2640e67da9bca5ad1444c8417bfaa28b629bf3db0674e311

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              c7384226bbdf013cb67ecb627958f896e74c28a921c8f54106d04e8ebd6a14ac8b48621333e682598068c217fed1b4cbba93f0cb34c9d3819402bfdae4d2bacf

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.7MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              f46f1fd729d297aeb3f6f596b1435991

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              92754a59bc9142b949cf5bcdd016ef70cc19a32a

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              d5e243a62ca20b7b2640e67da9bca5ad1444c8417bfaa28b629bf3db0674e311

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              c7384226bbdf013cb67ecb627958f896e74c28a921c8f54106d04e8ebd6a14ac8b48621333e682598068c217fed1b4cbba93f0cb34c9d3819402bfdae4d2bacf

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              646B

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              08871dea7c03a3bf663b57b6f1b77724

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              b3f7dbde12f4d78c66db84c0e9a382b1deff185c

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              d1f54adbea19466bad005681d9f0ad2da5c7821bd354e825b4dc59feeb13c24a

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              5cdc0de02bd0c3b30bcd2ecaab9ef53e2349bbc2c13b9f07849949c4952493dd83c6b525386c4dd80355696cbad4297527eb4cd50537f27f99aed5bd9a3524b9

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              5.2MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              58e22c0ee91280156cdaadacac7acddb

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              189c552c94a9b0ae0208763bca77f2801debc224

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              5.2MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              58e22c0ee91280156cdaadacac7acddb

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              189c552c94a9b0ae0208763bca77f2801debc224

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              40B

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              a69e7d625d8085bcdda188ecf3a881bc

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              caa43509715ebc4b7c95977bce44a8394604817b

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              fc079914e3be278a88e611ae7cee2787699b0a241bdcf33cb56d81c8780b2514

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              4bfcee1c68ecb8154543b25850186f507ad655bfa56226125ee2d469f0a961ff5d7bea9d774243572ed5a1ce4eb5ac8104176087d71c3ff31b3dbab5a0f15dd5

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Opera_installer_2212300355528253816.dll
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4.3MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              09ce9fd443ba9fb4c7ac6cf5c2b1ae53

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              029a9ab9c36da0756441d8346cbfece76e3820d5

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              ceeb8dd897035807425e9d24d0d2b71d65dccf7d8f834b777a587ba697655581

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              a3aafe2e6cf719b086759989229011ccc078c46bc456fb5a50c3b701cc5f4f8b16a4984b7dca6e51688d31a3ff40443cc80cce10a90a27c9eb5a40799900a893

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Opera_installer_2212300355549034256.dll
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4.3MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              09ce9fd443ba9fb4c7ac6cf5c2b1ae53

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              029a9ab9c36da0756441d8346cbfece76e3820d5

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              ceeb8dd897035807425e9d24d0d2b71d65dccf7d8f834b777a587ba697655581

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              a3aafe2e6cf719b086759989229011ccc078c46bc456fb5a50c3b701cc5f4f8b16a4984b7dca6e51688d31a3ff40443cc80cce10a90a27c9eb5a40799900a893

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Opera_installer_221230035557418812.dll
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4.3MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              09ce9fd443ba9fb4c7ac6cf5c2b1ae53

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              029a9ab9c36da0756441d8346cbfece76e3820d5

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              ceeb8dd897035807425e9d24d0d2b71d65dccf7d8f834b777a587ba697655581

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              a3aafe2e6cf719b086759989229011ccc078c46bc456fb5a50c3b701cc5f4f8b16a4984b7dca6e51688d31a3ff40443cc80cce10a90a27c9eb5a40799900a893

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Opera_installer_2212300356003764868.dll
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4.3MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              09ce9fd443ba9fb4c7ac6cf5c2b1ae53

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              029a9ab9c36da0756441d8346cbfece76e3820d5

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              ceeb8dd897035807425e9d24d0d2b71d65dccf7d8f834b777a587ba697655581

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              a3aafe2e6cf719b086759989229011ccc078c46bc456fb5a50c3b701cc5f4f8b16a4984b7dca6e51688d31a3ff40443cc80cce10a90a27c9eb5a40799900a893

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Opera_installer_2212300356031682084.dll
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4.3MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              09ce9fd443ba9fb4c7ac6cf5c2b1ae53

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              029a9ab9c36da0756441d8346cbfece76e3820d5

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              ceeb8dd897035807425e9d24d0d2b71d65dccf7d8f834b777a587ba697655581

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              a3aafe2e6cf719b086759989229011ccc078c46bc456fb5a50c3b701cc5f4f8b16a4984b7dca6e51688d31a3ff40443cc80cce10a90a27c9eb5a40799900a893

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              1bbf5dd0b6ca80e4c7c77495c3f33083

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              e0520037e60eb641ec04d1e814394c9da0a6a862

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              97KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              da1d0cd400e0b6ad6415fd4d90f69666

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              de9083d2902906cacf57259cf581b1466400b799

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              326KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              80d93d38badecdd2b134fe4699721223

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              326KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              80d93d38badecdd2b134fe4699721223

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • memory/812-603-0x0000000000400000-0x000000000090C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              5.0MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/812-673-0x0000000000400000-0x000000000090C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              5.0MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1476-964-0x0000000002FB0000-0x0000000003FB0000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              16.0MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1476-932-0x0000000002FB0000-0x0000000003FB0000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              16.0MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1476-904-0x0000000002FB0000-0x0000000003FB0000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              16.0MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1476-955-0x0000000002FB0000-0x0000000003FB0000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              16.0MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1476-884-0x0000000002FB0000-0x0000000003FB0000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              16.0MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1476-981-0x0000000002FB0000-0x0000000003FB0000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              16.0MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1476-990-0x0000000002FB0000-0x0000000003FB0000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              16.0MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1476-1073-0x0000000002FB0000-0x0000000003FB0000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              16.0MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2084-1603-0x0000000000400000-0x000000000090C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              5.0MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2084-825-0x0000000000400000-0x000000000090C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              5.0MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-163-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-129-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-154-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-149-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-146-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-143-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-138-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-133-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-153-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-159-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-145-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-144-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-152-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-155-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-157-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-158-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-142-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-160-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-141-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-161-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-140-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-139-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-162-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-137-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-151-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-136-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-165-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-135-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-134-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-132-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-150-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-164-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-115-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-131-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-128-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-116-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-117-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-130-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-147-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-156-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-127-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-118-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-126-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-119-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-125-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-124-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-123-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-148-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-121-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-122-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2672-120-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-176-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-295-0x0000000000F40000-0x0000000001328000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              3.9MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-168-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-174-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-172-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-226-0x0000000000F40000-0x0000000001328000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              3.9MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-856-0x0000000000F40000-0x0000000001328000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              3.9MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-171-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-177-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-178-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-179-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-181-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-170-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-248-0x0000000010000000-0x0000000010051000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              324KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-169-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-251-0x0000000005E00000-0x0000000006E0E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              16.1MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-173-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-298-0x0000000005E00000-0x0000000006E0E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              16.1MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3308-180-0x0000000077A00000-0x0000000077B8E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3816-1541-0x0000000000400000-0x000000000090C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              5.0MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3816-505-0x0000000000400000-0x000000000090C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              5.0MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/4256-580-0x0000000000400000-0x000000000090C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              5.0MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/4256-1601-0x0000000000400000-0x000000000090C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              5.0MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/4868-507-0x0000000000990000-0x0000000000D78000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              3.9MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/4868-824-0x0000000000400000-0x000000000090C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              5.0MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/4868-395-0x0000000000990000-0x0000000000D78000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              3.9MB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/4868-1554-0x0000000000400000-0x000000000090C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              5.0MB

                                                                                                                                                                                                                              Download