Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

TLauncher-...al.exe

windows10-1703-x64

8

Resubmissions

01/02/2023, 03:01

230201-dh2ahsde5s 8

01/02/2023, 02:57

230201-df2s9sbf34 8

Analysis

  • max time kernel
    243s
  • max time network
    181s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01/02/2023, 03:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TLauncher-2.871-Installer-1.0.6-global.exe

  • Size

    23.6MB

  • MD5

    7a4472a78d0651e11d20aa08e43cc045

  • SHA1

    aab1d5f80d7399ae2c1982201733be7681d100b1

  • SHA256

    318df7404e6c4d5538a6d31997b95af52bbb8d40caf5553b3cbd9b1bc4f6db96

  • SHA512

    c152c9d21b0615548173dcc61accb1a1afd5b6f98e6ec21f6a7119536397f07a54ad4087669716c3344dd338ce4f24cecf9989d472f65eaa18c87d496f23c681

  • SSDEEP

    393216:gXQLpnUN/n8IPfs/dQETVlOBbpFEj9GZ1GphRqV56Hpk7IXOzDnKI17fyVS:ggLFUp8aHExiTI3qqHp6zvKcfyVS

Score
8/10
discoverypersistencespywarestealerupx

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 64 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies registry class 46 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe" "__IRCT:3" "__IRTSS:24771453" "__IRSID:S-1-5-21-1099808672-3828198950-1535142148-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4788
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3200
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1840872" "__IRSID:S-1-5-21-1099808672-3828198950-1535142148-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1604
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3928
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x2fc,0x300,0x304,0x2d8,0x308,0x6e368658,0x6e368668,0x6e368674
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4300
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:1932
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3928 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230201040340" --session-guid=b1dea0ae-5a86-4ea4-ba75-d354acbe8a5f --server-tracking-blob=NzU1MTRhODViODRhYzJmNjQyMWJhMmMzYjUwM2U1Mjk4OTgxNjdjN2UzZWIyMTQ5NDdlZDkzOTgwNGRlMjRmNDp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzUyMjA2MTUuMDExMSIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiZWNkMDE3OGUtY2I3Yy00ZjAxLTllOTctMDcyYjU3MDExMzZjIn0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0005000000000000
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4696
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x308,0x30c,0x310,0x2d8,0x314,0x6d6e8658,0x6d6e8668,0x6d6e8674
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:2828
              • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe" --backend --initial-pid=3928 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010403401" --session-guid=b1dea0ae-5a86-4ea4-ba75-d354acbe8a5f --server-tracking-blob=NzU1MTRhODViODRhYzJmNjQyMWJhMmMzYjUwM2U1Mjk4OTgxNjdjN2UzZWIyMTQ5NDdlZDkzOTgwNGRlMjRmNDp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzUyMjA2MTUuMDExMSIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiZWNkMDE3OGUtY2I3Yy00ZjAxLTllOTctMDcyYjU3MDExMzZjIn0= --silent --desktopshortcut=1 --install-subfolder=94.0.4606.76
                7⤵
                • Executes dropped EXE
                • Registers COM server for autorun
                • Checks computer location settings
                • Loads dropped DLL
                • Enumerates connected drives
                • Modifies registry class
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3696
                • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe
                  C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x2a8,0x2ac,0x2b0,0x284,0x2b4,0x7ffef5e62c98,0x7ffef5e62ca8,0x7ffef5e62cb8
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:4516
                • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer_helper_64.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer_helper_64.exe" 1 "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010403401\Opera Browser.lnk"
                  8⤵
                  • Executes dropped EXE
                  • Checks computer location settings
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:3160
                • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --start-maximized
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4448
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Enumerates system info in registry
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:1272
                    • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_crashreporter.exe
                      C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ffeeb89c490,0x7ffeeb89c4a0,0x7ffeeb89c4b0
                      10⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1464
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1792,i,10260309063110293321,4502731372707036295,131072 /prefetch:2
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetWindowsHookEx
                      PID:2752
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=1908 --field-trial-handle=1792,i,10260309063110293321,4502731372707036295,131072 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetWindowsHookEx
                      PID:308
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010403401\assistant\_sfx.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010403401\assistant\_sfx.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2752
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010403401\assistant\assistant_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010403401\assistant\assistant_installer.exe" --version
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3092
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010403401\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010403401\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x2d0,0x2d4,0x2d8,0x2ac,0x2dc,0xab2dc0,0xab2dd0,0xab2ddc
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4456
      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
        "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4668
        • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
          "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
          4⤵
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          PID:2848
  • C:\Windows\System32\GameBarPresenceWriter.exe
    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
    1⤵
      PID:3456
    • C:\Windows\System32\GamePanel.exe
      "C:\Windows\System32\GamePanel.exe" 00000000000401F2 /startuptips
      1⤵
        PID:3680
      • C:\Windows\System32\bcastdvr.exe
        "C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
        1⤵
        • Drops desktop.ini file(s)
        PID:3652
      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher --flag-switches-begin --flag-switches-end --enable-quic --lowered-browser
        1⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:756
        • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_crashreporter.exe
          C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ffeeb89c490,0x7ffeeb89c4a0,0x7ffeeb89c4b0
          2⤵
          • Executes dropped EXE
          PID:3936
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1512 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:2
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4352
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=2040 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4332
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=2216 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3948
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=2768 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4420
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=2800 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4440
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=2816 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3940
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=2828 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4140
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=2840 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2184
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=2852 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3160
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --mojo-platform-channel-handle=3248 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Loads dropped DLL
          PID:1116
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=3264 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Loads dropped DLL
          PID:3412
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --mojo-platform-channel-handle=3648 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Loads dropped DLL
          PID:4268
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --mojo-platform-channel-handle=3664 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Loads dropped DLL
          PID:752
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --mojo-platform-channel-handle=3696 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Loads dropped DLL
          PID:2336
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=3704 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Loads dropped DLL
          PID:4704
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=3984 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Loads dropped DLL
          PID:4976
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=4164 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Loads dropped DLL
          PID:996
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=4280 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4220
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=4496 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          PID:4712
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=4556 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          PID:3636
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=4712 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          PID:4924
        • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" --pipeid=oauc_pipe2906202b27b41e4bd66c9238c4b575c1
          2⤵
          • Executes dropped EXE
          PID:2160
          • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe
            C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7dcc5ab38,0x7ff7dcc5ab48,0x7ff7dcc5ab58
            3⤵
            • Executes dropped EXE
            PID:2332
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=4732 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          PID:4028
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5252 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          PID:1260
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=5964 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          PID:4580
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=5976 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          PID:1152
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=5988 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          PID:2804
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=6000 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          PID:4340
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=6012 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          PID:3736
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=6024 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          PID:4980
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --mojo-platform-channel-handle=6220 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          PID:4840
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=5512 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          PID:420
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=6328 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          PID:2380
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=6352 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          PID:5164
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=6336 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          PID:5240
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=2892 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          PID:5316
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=7116 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          PID:5384
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=5648 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
          • Executes dropped EXE
          PID:5624
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=5644 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
          2⤵
            PID:5640
          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=6940 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
            2⤵
              PID:5664
            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=4536 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
              2⤵
                PID:5716
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=7320 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
                2⤵
                  PID:5740
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=7340 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
                  2⤵
                    PID:5784
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=7376 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
                    2⤵
                      PID:5832
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=7380 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
                      2⤵
                        PID:5860
                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=7388 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
                        2⤵
                          PID:5916
                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --ab_tests=DNA-77043-test:DNA-77043 --mojo-platform-channel-handle=3380 --field-trial-handle=1812,i,10029832786859403846,1468007415001138943,131072 /prefetch:8
                          2⤵
                            PID:6100
                          • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe" --edition --host=https://autoupdate.geo.opera.com/ --installationdatadir="C:\Users\Admin\AppData\Local\Programs\Opera" --installdir="C:\Users\Admin\AppData\Local\Programs\Opera" --lang=en-US --pipeid --producttype --requesttype=shutdown --version=94.0.4606.76 --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" --firstrunver=94.0.4606.76 --firstrunts=1675224286 --consent-info=eyJzdGF0aXN0aWNzX2NvbGxlY3Rpb25fZW5hYmxlZCI6dHJ1ZSwidXNlcl9leHBlcmllbmNlX21ldHJpY3NfcmVwb3J0aW5nX2VuYWJsZWQiOnRydWV9
                            2⤵
                              PID:6112
                              • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe
                                C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7dcc5ab38,0x7ff7dcc5ab48,0x7ff7dcc5ab58
                                3⤵
                                  PID:6140
                            • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                              C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate --autoupdaterequesttype=automatic --autoupdateoperaversion=94.0.4606.76 --newautoupdaterlogic
                              1⤵
                              • Executes dropped EXE
                              PID:2072
                              • C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe
                                "C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version
                                2⤵
                                  PID:5480
                                • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe" --pipeid=oauc_task_pipedcbb8f53eff625f232ff45d764476217 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015" --scheduledtask
                                  2⤵
                                  • Executes dropped EXE
                                  PID:5528
                                  • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe
                                    C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\Crash Reports" --crash-count-file=C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\crash_count.txt --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7dcc5ab38,0x7ff7dcc5ab48,0x7ff7dcc5ab58
                                    3⤵
                                    • Executes dropped EXE
                                    PID:5548
                              • C:\Windows\system32\taskmgr.exe
                                "C:\Windows\system32\taskmgr.exe" /4
                                1⤵
                                • Drops file in Windows directory
                                • Checks SCSI registry key(s)
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: GetForegroundWindowSpam
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:3928
                              • C:\Windows\system32\control.exe
                                "C:\Windows\system32\control.exe" SYSTEM
                                1⤵
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4964
                              • C:\Windows\SysWOW64\DllHost.exe
                                C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                1⤵
                                  PID:3480

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
                                  Filesize

                                  471B

                                  MD5

                                  9cbb254ca8da5a4099c66d7dce2d69de

                                  SHA1

                                  3f328e1410c5c4ea2fa2b387dbef7c6479ea258c

                                  SHA256

                                  f6cad04bfeb909acd5c89c6137fd33b267fa2e021553b3515c82e9d7cfb3fc58

                                  SHA512

                                  93fe3387c563d18ea2f9cb96f1d868d1d5a26c0490126242279a6f39a2df53311fc9806ee14b4b0301195a17dd75abc318695aa0a328330820e8fc20b6fed4a4

                                  Download Submit

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
                                  Filesize

                                  404B

                                  MD5

                                  31a23ef6589111d6c514fd46aa5f7e51

                                  SHA1

                                  b8c3c6fb4595429fba36c31d71c6b42bb839ba58

                                  SHA256

                                  3793c21547e5236477be0739ec682666b1b482a8ad9263e7285b28f336b036d9

                                  SHA512

                                  d1b2021f5a76822606ca5fa114f8d7b4ae8ba18a4d3b0efd47ccafe32b550add240e79e0f0f3ac622808927bcd6fa02c5f8e9c47106f39f6db47cb2142b2a903

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe
                                  Filesize

                                  6.0MB

                                  MD5

                                  a8438e013ced50f10d2746e88b3ccd8b

                                  SHA1

                                  548d7ae808404384d7318f475ced137c48e75c84

                                  SHA256

                                  826fe9ef17bd606029fe8d725855d90b6f35c73ae2ef7aae0c7e38e7b7bb9e33

                                  SHA512

                                  b77eb14e4cf719ea4c247b59eced0601d3074c70889ec1cc70e68448f3e2e707cebf4dde3bb489b5666ab23601b8fc4b4dcc5dd0904a12c8bf47c8377099b9ce

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe
                                  Filesize

                                  6.0MB

                                  MD5

                                  a8438e013ced50f10d2746e88b3ccd8b

                                  SHA1

                                  548d7ae808404384d7318f475ced137c48e75c84

                                  SHA256

                                  826fe9ef17bd606029fe8d725855d90b6f35c73ae2ef7aae0c7e38e7b7bb9e33

                                  SHA512

                                  b77eb14e4cf719ea4c247b59eced0601d3074c70889ec1cc70e68448f3e2e707cebf4dde3bb489b5666ab23601b8fc4b4dcc5dd0904a12c8bf47c8377099b9ce

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer_helper_64.exe
                                  Filesize

                                  1.1MB

                                  MD5

                                  2304e585c95968832a8780ea80c42e82

                                  SHA1

                                  c81f93a2b4f86d31db33ddcd2c6ae7afbc6cf07b

                                  SHA256

                                  2fc0b8910ebf498361fca32e4a62ef7a2775fa1ba88bb9c6178938d9ac510043

                                  SHA512

                                  f1fd64e14a13d669b8564d980e83a5e570461d4c77367e981a2b63276629e5579721bd8cfca8d4fcf050c49d8cd8e6b38a736e15181aa1d9b66190634a296091

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
                                  Filesize

                                  2.7MB

                                  MD5

                                  a8fda3b7c031a0634135bcd0de155197

                                  SHA1

                                  da2a5f122d522e1a31f629e79defb62226b5993c

                                  SHA256

                                  2335004d7a1455351a9c54e0b801d685a72ba879f8ffcd1bec1334581e452a33

                                  SHA512

                                  28799a0548f94cb1dd9d2ac0b1f9063e1d3fa2010c344b0ed756f98303b6d724b30abfe021ee8d5e247304cbf81ec0e395567c47bd20954218d3341bc9c88aab

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
                                  Filesize

                                  2.7MB

                                  MD5

                                  a8fda3b7c031a0634135bcd0de155197

                                  SHA1

                                  da2a5f122d522e1a31f629e79defb62226b5993c

                                  SHA256

                                  2335004d7a1455351a9c54e0b801d685a72ba879f8ffcd1bec1334581e452a33

                                  SHA512

                                  28799a0548f94cb1dd9d2ac0b1f9063e1d3fa2010c344b0ed756f98303b6d724b30abfe021ee8d5e247304cbf81ec0e395567c47bd20954218d3341bc9c88aab

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010403401\Opera Browser.lnk
                                  Filesize

                                  1KB

                                  MD5

                                  ec870f29bb5e71489b3f988f40c5ef9c

                                  SHA1

                                  47e4a4b0bddd16747c0e606c994e2416c48bebc2

                                  SHA256

                                  350e56e9f3ffa3a511586d0d746858295c63bbf4583d0d9c2abb5e206fc7081c

                                  SHA512

                                  265477be4375ab0cf79c378460534350831d5050816cf8b3f39a031512adec1a4be6280193e86276a3aac025f831e53732c963acee42b243caf1f5052c527a43

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010403401\assistant\_sfx.exe
                                  Filesize

                                  1.7MB

                                  MD5

                                  0238df215bf6943892daf85de8ad433a

                                  SHA1

                                  3d905e4e2c0e9170df61b7a199321847691f945e

                                  SHA256

                                  a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

                                  SHA512

                                  fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010403401\assistant\_sfx.exe
                                  Filesize

                                  1.7MB

                                  MD5

                                  0238df215bf6943892daf85de8ad433a

                                  SHA1

                                  3d905e4e2c0e9170df61b7a199321847691f945e

                                  SHA256

                                  a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

                                  SHA512

                                  fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010403401\assistant\assistant_installer.exe
                                  Filesize

                                  2.1MB

                                  MD5

                                  9df6e2fbb7e38964f35016bf91ef7424

                                  SHA1

                                  d0c1266dc46814bc6165cf6a69e90581228989a7

                                  SHA256

                                  3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

                                  SHA512

                                  b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010403401\assistant\assistant_installer.exe
                                  Filesize

                                  2.1MB

                                  MD5

                                  9df6e2fbb7e38964f35016bf91ef7424

                                  SHA1

                                  d0c1266dc46814bc6165cf6a69e90581228989a7

                                  SHA256

                                  3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

                                  SHA512

                                  b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010403401\assistant\assistant_installer.exe
                                  Filesize

                                  2.1MB

                                  MD5

                                  9df6e2fbb7e38964f35016bf91ef7424

                                  SHA1

                                  d0c1266dc46814bc6165cf6a69e90581228989a7

                                  SHA256

                                  3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

                                  SHA512

                                  b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010403401\opera_package
                                  Filesize

                                  86.7MB

                                  MD5

                                  038275aad393989e8c0b6634da083fc7

                                  SHA1

                                  65b4ebd22a289935b71d41077a06eeda11eed154

                                  SHA256

                                  ac96d0fca59c713690e2dd0d899c90d0c27ad4784f8425656ae14aefdaca3d05

                                  SHA512

                                  2dd5bdfa1e500232ac0ac06030db3b73b3a5af2a8d9fa1601913deeb853ec99249387bc96f5efa25919fa3ef2bf1c512e21dd07b2baecccacfa90548cd21a4d8

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010403401\pref_default_overrides
                                  Filesize

                                  57B

                                  MD5

                                  f488c9f9d9d5e631484d4bf155f45442

                                  SHA1

                                  0f0e624770e47bea5186748a9de85c677dd84fa7

                                  SHA256

                                  e6f214ff5ccbbe6e7abcf309138cdcb46d3fe3915e9bbbe8dd3c15afb439f708

                                  SHA512

                                  d72d1daa86e650a0589f6991f7a7bb3b7ca3484d49bc0d0d703b28b8f399f3123df2bf3c949a899fab55bde7d888736f655e462e2cd02ade59bbf9e67df54064

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                  Filesize

                                  1.8MB

                                  MD5

                                  aa4de04ccc16b74a4c2301da8d621ec1

                                  SHA1

                                  d05c6d8200f6e6b1283df82d24d687adc47d9664

                                  SHA256

                                  e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                                  SHA512

                                  28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                  Filesize

                                  1.8MB

                                  MD5

                                  aa4de04ccc16b74a4c2301da8d621ec1

                                  SHA1

                                  d05c6d8200f6e6b1283df82d24d687adc47d9664

                                  SHA256

                                  e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                                  SHA512

                                  28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                  Filesize

                                  1.3MB

                                  MD5

                                  7e08af319c9eb3297e09ca7bb8387de4

                                  SHA1

                                  4cf091f77a3eb9437ef33985e64bd10c1257284f

                                  SHA256

                                  6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                                  SHA512

                                  bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                  Filesize

                                  1.3MB

                                  MD5

                                  7e08af319c9eb3297e09ca7bb8387de4

                                  SHA1

                                  4cf091f77a3eb9437ef33985e64bd10c1257284f

                                  SHA256

                                  6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                                  SHA512

                                  bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
                                  Filesize

                                  326KB

                                  MD5

                                  80d93d38badecdd2b134fe4699721223

                                  SHA1

                                  e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                  SHA256

                                  c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                  SHA512

                                  9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                  Filesize

                                  1.3MB

                                  MD5

                                  e801c5847f5f9d207db53aaaf5c6f3a2

                                  SHA1

                                  8e6818ce66555e2cca92e5c5f32551fb4a91645e

                                  SHA256

                                  196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                                  SHA512

                                  303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                  Filesize

                                  1.3MB

                                  MD5

                                  e801c5847f5f9d207db53aaaf5c6f3a2

                                  SHA1

                                  8e6818ce66555e2cca92e5c5f32551fb4a91645e

                                  SHA256

                                  196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                                  SHA512

                                  303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
                                  Filesize

                                  326KB

                                  MD5

                                  80d93d38badecdd2b134fe4699721223

                                  SHA1

                                  e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                  SHA256

                                  c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                  SHA512

                                  9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                  Filesize

                                  2.7MB

                                  MD5

                                  a8fda3b7c031a0634135bcd0de155197

                                  SHA1

                                  da2a5f122d522e1a31f629e79defb62226b5993c

                                  SHA256

                                  2335004d7a1455351a9c54e0b801d685a72ba879f8ffcd1bec1334581e452a33

                                  SHA512

                                  28799a0548f94cb1dd9d2ac0b1f9063e1d3fa2010c344b0ed756f98303b6d724b30abfe021ee8d5e247304cbf81ec0e395567c47bd20954218d3341bc9c88aab

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                  Filesize

                                  2.7MB

                                  MD5

                                  a8fda3b7c031a0634135bcd0de155197

                                  SHA1

                                  da2a5f122d522e1a31f629e79defb62226b5993c

                                  SHA256

                                  2335004d7a1455351a9c54e0b801d685a72ba879f8ffcd1bec1334581e452a33

                                  SHA512

                                  28799a0548f94cb1dd9d2ac0b1f9063e1d3fa2010c344b0ed756f98303b6d724b30abfe021ee8d5e247304cbf81ec0e395567c47bd20954218d3341bc9c88aab

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                  Filesize

                                  2.7MB

                                  MD5

                                  a8fda3b7c031a0634135bcd0de155197

                                  SHA1

                                  da2a5f122d522e1a31f629e79defb62226b5993c

                                  SHA256

                                  2335004d7a1455351a9c54e0b801d685a72ba879f8ffcd1bec1334581e452a33

                                  SHA512

                                  28799a0548f94cb1dd9d2ac0b1f9063e1d3fa2010c344b0ed756f98303b6d724b30abfe021ee8d5e247304cbf81ec0e395567c47bd20954218d3341bc9c88aab

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                  Filesize

                                  2.7MB

                                  MD5

                                  a8fda3b7c031a0634135bcd0de155197

                                  SHA1

                                  da2a5f122d522e1a31f629e79defb62226b5993c

                                  SHA256

                                  2335004d7a1455351a9c54e0b801d685a72ba879f8ffcd1bec1334581e452a33

                                  SHA512

                                  28799a0548f94cb1dd9d2ac0b1f9063e1d3fa2010c344b0ed756f98303b6d724b30abfe021ee8d5e247304cbf81ec0e395567c47bd20954218d3341bc9c88aab

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                  Filesize

                                  2.7MB

                                  MD5

                                  a8fda3b7c031a0634135bcd0de155197

                                  SHA1

                                  da2a5f122d522e1a31f629e79defb62226b5993c

                                  SHA256

                                  2335004d7a1455351a9c54e0b801d685a72ba879f8ffcd1bec1334581e452a33

                                  SHA512

                                  28799a0548f94cb1dd9d2ac0b1f9063e1d3fa2010c344b0ed756f98303b6d724b30abfe021ee8d5e247304cbf81ec0e395567c47bd20954218d3341bc9c88aab

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
                                  Filesize

                                  648B

                                  MD5

                                  5cf086b9031c088cc38ba00f2fa51792

                                  SHA1

                                  626955b2d76f589cc619db636df3607e11ba1f17

                                  SHA256

                                  716cb7b8c9dd20bd83ab70b69d6b1800674394faa2117a037b7db7a1267725b0

                                  SHA512

                                  8c1add8d48c494daf38a44b8401db59e8d0a8275e2f1979d50bbf67859080f05b52ed01a6ca2007cc971b164314f29936a6e90100af192f034c087d4433accf7

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                                  Filesize

                                  5.2MB

                                  MD5

                                  58e22c0ee91280156cdaadacac7acddb

                                  SHA1

                                  189c552c94a9b0ae0208763bca77f2801debc224

                                  SHA256

                                  765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

                                  SHA512

                                  9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                                  Filesize

                                  5.2MB

                                  MD5

                                  58e22c0ee91280156cdaadacac7acddb

                                  SHA1

                                  189c552c94a9b0ae0208763bca77f2801debc224

                                  SHA256

                                  765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

                                  SHA512

                                  9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\aopalliance\aopalliance\1.0\aopalliance-1.0.jar
                                  Filesize

                                  4KB

                                  MD5

                                  04177054e180d09e3998808efa0401c7

                                  SHA1

                                  0235ba8b489512805ac13a8f9ea77a1ca5ebe3e8

                                  SHA256

                                  0addec670fedcd3f113c5c8091d783280d23f75e3acb841b61a9cdb079376a08

                                  SHA512

                                  3f44a932d8c00cfeee2eb057bcd7c301a2d029063e0a916e1e20b3aec4877d19d67a2fd8aaf58fa2d5a00133d1602128a7f50912ffb6cabc7b0fdc7fbda3f8a1

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\github\junrar\junrar\0.7\junrar-0.7.jar
                                  Filesize

                                  151KB

                                  MD5

                                  75a215b9e921044cd2c88e73f6cb9745

                                  SHA1

                                  18cc717b85af0b12ba922abf415c2ff4716f8219

                                  SHA256

                                  7c764fa1af319b98ff452189ab31bb722ea74ed7a52b17b0c6282249c10a61fc

                                  SHA512

                                  1a44af2f3f8dbfbf38ad5f71ef11b32d5822d734f77af2cdea419fb6af845e894acb60bffbcebb4533068d86b55a22a8b0f74be20b204c2343bdb165d9c787f9

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\guava\guava\19.0\guava-19.0.jar
                                  Filesize

                                  2.2MB

                                  MD5

                                  43bfc49bdc7324f6daaa60c1ee9f3972

                                  SHA1

                                  6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9

                                  SHA256

                                  58d4cc2e05ebb012bbac568b032f75623be1cb6fb096f3c60c72a86f7f057de4

                                  SHA512

                                  834f2bf4a5b35edffde0263409649aeaf34ca9a742ba511a06bb9b01626f9e774d2d3c8ba91a7905929dc8cd5e6471de29f7d0ab10260ece2af709b7fdbe4bc3

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\extentions\guice-assistedinject\4.1.0\guice-assistedinject-4.1.0.jar
                                  Filesize

                                  41KB

                                  MD5

                                  65912196b6e91f2ceb933001c1fb5c94

                                  SHA1

                                  af799dd7e23e6fe8c988da12314582072b07edcb

                                  SHA256

                                  663728123fb9a6b79ea39ae289e5d56b4113e1b8e9413eb792f91e53a6dd5868

                                  SHA512

                                  60b15182130ddfd801dd0438058d641dd5ba9122f2d1e081eb63f5e2c12fff0271d9d47c58925be0be8267ed22ae893ea9d1b251faba17dc1d2552b5d93056de

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\guice\4.1.0\guice-4.1.0.jar
                                  Filesize

                                  658KB

                                  MD5

                                  41f66d1d4d250efebde3bbf8b2d55dfa

                                  SHA1

                                  eeb69005da379a10071aa4948c48d89250febb07

                                  SHA256

                                  9b9df27a5b8c7864112b4137fd92b36c3f1395bfe57be42fedf2f520ead1a93e

                                  SHA512

                                  109a1595668293b32376e885ad59e0e4c0e088ea00f58119f0f7d0d2055f03eb93a9f92d974b6dbd56ef721792ac03c889d9add3a2850aa7ccd732c2682d17ef

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\dnsjava\dnsjava\2.1.8\dnsjava-2.1.8.jar
                                  Filesize

                                  307KB

                                  MD5

                                  540f330717bca9d29c8762cf6daca443

                                  SHA1

                                  eed8a2cbf56cc60d07a189a429ead3067564193c

                                  SHA256

                                  52de1ff2a7556ac2cc4284abd7123bc3d6274210fc4e3b1d9ba90efad5f6a153

                                  SHA512

                                  a4bcb8bbb43906f42faf1802c504ccc9c616e49afd5dd7db77676d13aaed79a300979ffc2195b680a9c6d5f03466b611b6f1338d824099816aa224b234760f4b

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\javax\inject\javax.inject\1\javax.inject-1.jar
                                  Filesize

                                  2KB

                                  MD5

                                  289075e48b909e9e74e6c915b3631d2e

                                  SHA1

                                  6975da39a7040257bd51d21a231b76c915872d38

                                  SHA256

                                  91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff

                                  SHA512

                                  e126b7ccf3e42fd1984a0beef1004a7269a337c202e59e04e8e2af714280d2f2d8d2ba5e6f59481b8dcd34aaf35c966a688d0b48ec7e96f102c274dc0d3b381e

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\log4j\log4j\1.2.17\log4j-1.2.17.jar
                                  Filesize

                                  478KB

                                  MD5

                                  04a41f0a068986f0f73485cf507c0f40

                                  SHA1

                                  5af35056b4d257e4b64b9e8069c0746e8b08629f

                                  SHA256

                                  1d31696445697720527091754369082a6651bd49781b6005deb94e56753406f9

                                  SHA512

                                  3f12937a69ba60d0f5e86265168d6a0d069ce20d95b99a3ace463987655e7c63053f4d7e36e32f2b53f86992b888ca477bf81253ad04c721896b397f94ee57fc

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\net\sf\jopt-simple\jopt-simple\4.9\jopt-simple-4.9.jar
                                  Filesize

                                  64KB

                                  MD5

                                  39c6476e4de3d4f90ad4ca0ddca48ec2

                                  SHA1

                                  ee9e9eaa0a35360dcfeac129ff4923215fd65904

                                  SHA256

                                  26c5856e954b5f864db76f13b86919b59c6eecf9fd930b96baa8884626baf2f5

                                  SHA512

                                  fd04c19bce810a1548b2d2eaadb915cff2cbc81a81ec5258aafc1ba329100daedc49edad1fc7b254ab892996796124283d7004b5414f662c0efa3979add9ca5f

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\commons\commons-lang3\3.4\commons-lang3-3.4.jar
                                  Filesize

                                  424KB

                                  MD5

                                  8667a442ee77e509fbe8176b94726eb2

                                  SHA1

                                  5fe28b9518e58819180a43a850fbc0dd24b7c050

                                  SHA256

                                  734c8356420cc8e30c795d64fd1fcd5d44ea9d90342a2cc3262c5158fbc6d98b

                                  SHA512

                                  b1b556692341a240f8b81f8f71b8b5c0225ccf857ce1b185e7fe6d7a9bb2a4d77823496cd6e2697a20386e7f3ba02d476a0e4ff38071367beb3090104544922d

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\httpcomponents\fluent-hc\4.5.13\fluent-hc-4.5.13.jar
                                  Filesize

                                  30KB

                                  MD5

                                  8f7e4f1a95a870ebee87ddacc425362c

                                  SHA1

                                  300bf1846737e34b9ea10faae257ca8fdcd0616f

                                  SHA256

                                  f883b6b027d5e05c53e48e4fe3548715c52dbd590ffa3f52d039574f1a4d0728

                                  SHA512

                                  98e30ed27d6ac078450efe5e236117445c93e05eb280399e056816c52643a3a33adce5e3a885ce8488186f38d05e0fb6c65dfcbaa509be8c6047ef2f0870d9b0

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\logging\log4j\log4j-core\2.14.1\log4j-core-2.14.1.jar
                                  Filesize

                                  1.7MB

                                  MD5

                                  948dda787593340a7af1a18e328b7b7f

                                  SHA1

                                  9141212b8507ab50a45525b545b39d224614528b

                                  SHA256

                                  ade7402a70667a727635d5c4c29495f4ff96f061f12539763f6f123973b465b0

                                  SHA512

                                  6e41ff42f12deedb8da06cbed73d0a9a5389660b7ee058436f8fcb6b14a6ab3105faf8e3f2c007d38ccc85af1e704505b84be5a80d8e68a434aae82b54b85f70

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\picture-bundle\3.5\picture-bundle-3.5.jar
                                  Filesize

                                  2.1MB

                                  MD5

                                  c93265b9d8bbe2b8d07f34893e5945c4

                                  SHA1

                                  ad0a3c5e104b95f842998d39c6a50f38b7bf1d03

                                  SHA256

                                  7238f234112b746de9dd96d7cafe34436c3f43a9f4ebd5659a38e5ba1b11d277

                                  SHA512

                                  0cbc136d1034ea72729cbe70e4459d015a1e4afde087f2abacb0d90603e344f828736a4c9c35e2b29e169e015ba14ddd2073694dfb789b16616275d6b89a6383

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\skin-server-API\1.0\skin-server-API-1.0.jar
                                  Filesize

                                  14KB

                                  MD5

                                  13a8e72587ac6eacfb0986f75e51eb7c

                                  SHA1

                                  6c3daf89705427f73e6106d2d4d9619e99c5ecb5

                                  SHA256

                                  1fcffa073f722737431e2699b1f3ea48b92a3b825397d8f0d1464e4d4d15a014

                                  SHA512

                                  134735390415f60d0c42ff33a060bda508e273b35fc9aab271c20ff23f331b51cf3fa36443009e0987049f6bfb22c4098a1473e65ea0349e719fbf4b528f344e

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\tlauncher-resource\1.4\tlauncher-resource-1.4.jar
                                  Filesize

                                  3.2MB

                                  MD5

                                  acbc8aa5ba5cdddf5f1e67befe8cc597

                                  SHA1

                                  63b4bf89744b532e65c1afa3294743d2b3798f2b

                                  SHA256

                                  1f46b3a163012f9729905633b5e5e03ce385066ae43138a564729c942f9ca6b9

                                  SHA512

                                  d974a032d9af451c0dd51fbc0d64840f3e03eb502f40e4ab60d6722913b8a48d44a75752fcff60656e4d19089570a894222959745af11bcdf93ea1544192fee3

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tukaani\xz\1.5\xz-1.5.jar
                                  Filesize

                                  97KB

                                  MD5

                                  51050e595b308c4aec8ac314f66e18bc

                                  SHA1

                                  9c64274b7dbb65288237216e3fae7877fd3f2bee

                                  SHA256

                                  86f30fa8775fa3a62cdb39d1ed78a6019164c1058864048d42cbee244e26e840

                                  SHA512

                                  c5c130bf22f24f61b57fc0c6243e7f961ca2a8928416e8bb288aec6650c1c1c06ace4383913cd1277fc6785beb9a74458807ea7e3d6b2e09189cfaf2fb9ab7e1

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                                  Filesize

                                  40B

                                  MD5

                                  d4903c7a24b189afa773e67d64bfd847

                                  SHA1

                                  79abcf447bd76337be3fe2101cd73de65b5cf5b9

                                  SHA256

                                  d28cb02b670b22b64931231ac57b55762ed36f2a57ee00ef3b4674ca0b3115fa

                                  SHA512

                                  224cdf99850e47fc0e3f822dd08f8fa73c6ec9d5e6c747fb64157ec78248d419d882f943a10fec105fecbfb8a006431ef2cb894ca636dc370cab277d5efa53b0

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                                  Filesize

                                  40B

                                  MD5

                                  d4903c7a24b189afa773e67d64bfd847

                                  SHA1

                                  79abcf447bd76337be3fe2101cd73de65b5cf5b9

                                  SHA256

                                  d28cb02b670b22b64931231ac57b55762ed36f2a57ee00ef3b4674ca0b3115fa

                                  SHA512

                                  224cdf99850e47fc0e3f822dd08f8fa73c6ec9d5e6c747fb64157ec78248d419d882f943a10fec105fecbfb8a006431ef2cb894ca636dc370cab277d5efa53b0

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                                  Filesize

                                  40B

                                  MD5

                                  d4903c7a24b189afa773e67d64bfd847

                                  SHA1

                                  79abcf447bd76337be3fe2101cd73de65b5cf5b9

                                  SHA256

                                  d28cb02b670b22b64931231ac57b55762ed36f2a57ee00ef3b4674ca0b3115fa

                                  SHA512

                                  224cdf99850e47fc0e3f822dd08f8fa73c6ec9d5e6c747fb64157ec78248d419d882f943a10fec105fecbfb8a006431ef2cb894ca636dc370cab277d5efa53b0

                                  Download Submit

                                • \Users\Admin\AppData\Local\Temp\Opera_installer_2302010403355533928.dll
                                  Filesize

                                  4.3MB

                                  MD5

                                  832ae69091fba73338df9103db4f8be1

                                  SHA1

                                  d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

                                  SHA256

                                  191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

                                  SHA512

                                  b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

                                  Download Submit

                                • \Users\Admin\AppData\Local\Temp\Opera_installer_2302010403379434300.dll
                                  Filesize

                                  4.3MB

                                  MD5

                                  832ae69091fba73338df9103db4f8be1

                                  SHA1

                                  d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

                                  SHA256

                                  191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

                                  SHA512

                                  b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

                                  Download Submit

                                • \Users\Admin\AppData\Local\Temp\Opera_installer_2302010403399951932.dll
                                  Filesize

                                  4.3MB

                                  MD5

                                  832ae69091fba73338df9103db4f8be1

                                  SHA1

                                  d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

                                  SHA256

                                  191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

                                  SHA512

                                  b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

                                  Download Submit

                                • \Users\Admin\AppData\Local\Temp\Opera_installer_2302010403422194696.dll
                                  Filesize

                                  4.3MB

                                  MD5

                                  832ae69091fba73338df9103db4f8be1

                                  SHA1

                                  d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

                                  SHA256

                                  191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

                                  SHA512

                                  b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

                                  Download Submit

                                • \Users\Admin\AppData\Local\Temp\Opera_installer_2302010403431722828.dll
                                  Filesize

                                  4.3MB

                                  MD5

                                  832ae69091fba73338df9103db4f8be1

                                  SHA1

                                  d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

                                  SHA256

                                  191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

                                  SHA512

                                  b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

                                  Download Submit

                                • \Users\Admin\AppData\Local\Temp\Opera_installer_2302010404415363696.dll
                                  Filesize

                                  5.3MB

                                  MD5

                                  9b04d6bc0a44cb92ca307e730c0873ca

                                  SHA1

                                  85ac75c07b9798668b3273de693e4556eb198bcf

                                  SHA256

                                  fdb050d2fa5ca39d5e666adeedcb1aa28a4c6356706e6ed6d4fb18e4103af5e2

                                  SHA512

                                  5f496ad175cd49cf9cb095f3bd0fa4f0227e319e045f32ce8f77380f2a2a4b5b9425b5161a69172b74aeea0667b59fe7fa01d1eea0f39971d3c357ccb9870ead

                                  Download Submit

                                • \Users\Admin\AppData\Local\Temp\Opera_installer_2302010404422704516.dll
                                  Filesize

                                  5.3MB

                                  MD5

                                  9b04d6bc0a44cb92ca307e730c0873ca

                                  SHA1

                                  85ac75c07b9798668b3273de693e4556eb198bcf

                                  SHA256

                                  fdb050d2fa5ca39d5e666adeedcb1aa28a4c6356706e6ed6d4fb18e4103af5e2

                                  SHA512

                                  5f496ad175cd49cf9cb095f3bd0fa4f0227e319e045f32ce8f77380f2a2a4b5b9425b5161a69172b74aeea0667b59fe7fa01d1eea0f39971d3c357ccb9870ead

                                  Download Submit

                                • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
                                  Filesize

                                  1.7MB

                                  MD5

                                  1bbf5dd0b6ca80e4c7c77495c3f33083

                                  SHA1

                                  e0520037e60eb641ec04d1e814394c9da0a6a862

                                  SHA256

                                  bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

                                  SHA512

                                  97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

                                  Download Submit

                                • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
                                  Filesize

                                  97KB

                                  MD5

                                  da1d0cd400e0b6ad6415fd4d90f69666

                                  SHA1

                                  de9083d2902906cacf57259cf581b1466400b799

                                  SHA256

                                  7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

                                  SHA512

                                  f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

                                  Download Submit

                                • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
                                  Filesize

                                  326KB

                                  MD5

                                  80d93d38badecdd2b134fe4699721223

                                  SHA1

                                  e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                  SHA256

                                  c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                  SHA512

                                  9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                  Download Submit

                                • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
                                  Filesize

                                  326KB

                                  MD5

                                  80d93d38badecdd2b134fe4699721223

                                  SHA1

                                  e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                  SHA256

                                  c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                  SHA512

                                  9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                  Download Submit

                                • memory/1604-488-0x0000000000970000-0x0000000000D58000-memory.dmp

                                  Filesize

                                  3.9MB

                                  Download

                                • memory/1604-367-0x0000000000970000-0x0000000000D58000-memory.dmp

                                  Filesize

                                  3.9MB

                                  Download

                                • memory/1932-681-0x0000000000400000-0x0000000000908000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/2432-137-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-121-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-164-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-166-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-163-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-162-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-161-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-160-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-159-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-117-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-158-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-118-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-157-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-156-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-155-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-119-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-120-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-153-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-154-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-152-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-151-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-150-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-116-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-133-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-134-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-135-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-131-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-136-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-149-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-132-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-122-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-123-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-148-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-138-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-147-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-165-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-146-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-145-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-124-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-144-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-143-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-142-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-125-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-141-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-140-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-126-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-127-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-128-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-130-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-129-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2432-139-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/2828-821-0x0000000000400000-0x0000000000908000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/2828-1327-0x0000000000400000-0x0000000000908000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/2848-1096-0x00000000027C0000-0x00000000037C0000-memory.dmp

                                  Filesize

                                  16.0MB

                                  Download

                                • memory/2848-1099-0x00000000027C0000-0x00000000037C0000-memory.dmp

                                  Filesize

                                  16.0MB

                                  Download

                                • memory/2848-1069-0x00000000027C0000-0x00000000037C0000-memory.dmp

                                  Filesize

                                  16.0MB

                                  Download

                                • memory/2848-1061-0x00000000027C0000-0x00000000037C0000-memory.dmp

                                  Filesize

                                  16.0MB

                                  Download

                                • memory/2848-1050-0x00000000027C0000-0x00000000037C0000-memory.dmp

                                  Filesize

                                  16.0MB

                                  Download

                                • memory/2848-1137-0x00000000027C0000-0x00000000037C0000-memory.dmp

                                  Filesize

                                  16.0MB

                                  Download

                                • memory/2848-1090-0x00000000027C0000-0x00000000037C0000-memory.dmp

                                  Filesize

                                  16.0MB

                                  Download

                                • memory/3928-1167-0x0000000000400000-0x0000000000908000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/3928-829-0x0000000000400000-0x0000000000908000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/3928-497-0x0000000000400000-0x0000000000908000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/4300-830-0x0000000000400000-0x0000000000908000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/4300-1261-0x0000000000400000-0x0000000000908000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/4696-831-0x0000000000400000-0x0000000000908000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/4696-1210-0x0000000000400000-0x0000000000908000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/4788-172-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/4788-169-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/4788-178-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/4788-174-0x0000000001080000-0x0000000001468000-memory.dmp

                                  Filesize

                                  3.9MB

                                  Download

                                • memory/4788-181-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/4788-285-0x00000000061A0000-0x00000000071AF000-memory.dmp

                                  Filesize

                                  16.1MB

                                  Download

                                • memory/4788-182-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/4788-171-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/4788-250-0x00000000061A0000-0x00000000071AF000-memory.dmp

                                  Filesize

                                  16.1MB

                                  Download

                                • memory/4788-180-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/4788-173-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/4788-284-0x0000000001080000-0x0000000001468000-memory.dmp

                                  Filesize

                                  3.9MB

                                  Download

                                • memory/4788-179-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/4788-176-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/4788-183-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/4788-175-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/4788-170-0x0000000076EF0000-0x000000007707E000-memory.dmp

                                  Filesize

                                  1.6MB

                                  Download

                                • memory/4788-245-0x0000000010000000-0x0000000010051000-memory.dmp

                                  Filesize

                                  324KB

                                  Download

                                • memory/4788-1045-0x0000000001080000-0x0000000001468000-memory.dmp

                                  Filesize

                                  3.9MB

                                  Download