Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://tlauncher.or...

windows7-x64

8

https://tlauncher.or...

windows10-2004-x64

1

Analysis

  • max time kernel
    129s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    13/02/2023, 11:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://tlauncher.org/en/

Score
8/10
discoverypersistencespywarestealerupx

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 49 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 40 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://tlauncher.org/en/
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1532
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1532 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:524
    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X8FNYYS1\TLauncher-2.871-Installer-1.0.6-global.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X8FNYYS1\TLauncher-2.871-Installer-1.0.6-global.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1044
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X8FNYYS1\TLauncher-2.871-Installer-1.0.6-global.exe" "__IRCT:3" "__IRTSS:24771453" "__IRSID:S-1-5-21-3385717845-2518323428-350143044-1000"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:872
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1312
          • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
            "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1840872" "__IRSID:S-1-5-21-3385717845-2518323428-350143044-1000"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1652
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Modifies system certificate store
              • Suspicious use of WriteProcessMemory
              PID:2144
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.37 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x7079e428,0x7079e438,0x7079e444
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2224
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2336
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2144 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230213120500" --session-guid=2b4d43bb-1938-47e0-b018-c8247e4a4025 --server-tracking-blob=YzI4Njg1ODcwYmJlOWNhNTgzOWM0YTgxZDBhMjFiMDRhZjhkMWJhMGVlNjczZDU2YzY2NzlmMjg0OGJiMWM4ODp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzYyODYyOTQuNzA2NCIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiOTE4YTQ3YmYtNmI1OS00YTIxLTg5M2EtNjRmYzhkNzM3ZmQ4In0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=3403000000000000
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates connected drives
                • Suspicious use of WriteProcessMemory
                PID:2384
                • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                  C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.37 --initial-client-data=0x1b0,0x1b4,0x1b8,0x178,0x1bc,0x6fcae428,0x6fcae438,0x6fcae444
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2472
                • C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\installer.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\installer.exe" --backend --initial-pid=2144 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302131205001" --session-guid=2b4d43bb-1938-47e0-b018-c8247e4a4025 --server-tracking-blob=YzI4Njg1ODcwYmJlOWNhNTgzOWM0YTgxZDBhMjFiMDRhZjhkMWJhMGVlNjczZDU2YzY2NzlmMjg0OGJiMWM4ODp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzYyODYyOTQuNzA2NCIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiOTE4YTQ3YmYtNmI1OS00YTIxLTg5M2EtNjRmYzhkNzM3ZmQ4In0= --silent --desktopshortcut=1 --install-subfolder=95.0.4635.37
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Enumerates connected drives
                  • Modifies registry class
                  PID:2752
                  • C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\installer.exe
                    C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.37 --initial-client-data=0x174,0x178,0x17c,0x148,0x180,0x7fef606a908,0x7fef606a918,0x7fef606a928
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2772
                  • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --start-maximized
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2880
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2920
                      • C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\opera_crashreporter.exe
                        C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.37 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x7feedfb3a18,0x7feedfb3a28,0x7feedfb3a38
                        11⤵
                        • Executes dropped EXE
                        PID:2936
                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1036 --field-trial-handle=1188,i,9216645460161950874,15397356990413236329,131072 /prefetch:2
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:428
                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1376 --field-trial-handle=1188,i,9216645460161950874,15397356990413236329,131072 /prefetch:8
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:1684
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302131205001\assistant\_sfx.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302131205001\assistant\_sfx.exe"
                7⤵
                • Executes dropped EXE
                PID:2636
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302131205001\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302131205001\assistant\assistant_installer.exe" --version
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2672
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302131205001\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302131205001\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0x3f2dc0,0x3f2dd0,0x3f2ddc
                  8⤵
                  • Executes dropped EXE
                  PID:2692
        • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
          "C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
          4⤵
          • Executes dropped EXE
          PID:2652
  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher --flag-switches-begin --flag-switches-end --enable-quic --lowered-browser
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:908
    • C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\opera_crashreporter.exe
      C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.37 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0xd5c3a18,0xd5c3a28,0xd5c3a38
      2⤵
      • Executes dropped EXE
      PID:1508
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1092 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:2
      2⤵
      • Executes dropped EXE
      PID:1080
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1468 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:2648
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1376 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:2632
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1972 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:2692
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1992 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:2912
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=2004 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:1764
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=2016 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:2296
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=2028 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:2144
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=2040 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:2992
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --mojo-platform-channel-handle=2068 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:2956
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=2076 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:1548
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --mojo-platform-channel-handle=2448 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:2844
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --mojo-platform-channel-handle=2456 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:1936
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --mojo-platform-channel-handle=2480 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:1
      2⤵
      • Executes dropped EXE
      PID:3052
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=2496 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:2692
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=2800 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:1800
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:2540
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=3112 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:2912
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=3524 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:2960
    • C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\opera_autoupdate.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" --pipeid=oauc_pipe2906202b27b41e4bd66c9238c4b575c1
      2⤵
      • Executes dropped EXE
      PID:2944
      • C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\opera_autoupdate.exe
        C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.37 --initial-client-data=0x138,0x13c,0x140,0x10c,0x144,0x14007cbd8,0x14007cbe8,0x14007cbf8
        3⤵
        • Executes dropped EXE
        PID:2584
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=3588 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:2892
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=3604 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:2516
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=3620 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:2620
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1972 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:2688
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=3096 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
      2⤵
        PID:3112
      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=2524 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
        2⤵
          PID:3200
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=2752 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
          2⤵
            PID:3364
          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=3152 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
            2⤵
              PID:3504
            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=2036 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
              2⤵
                PID:3624
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1980 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
                2⤵
                  PID:3704
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=2244 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
                  2⤵
                    PID:3864
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1924 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
                    2⤵
                      PID:3964
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=3796 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
                      2⤵
                        PID:3092
                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=3808 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
                        2⤵
                          PID:3184
                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3784 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:2
                          2⤵
                            PID:2156
                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=2336 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
                            2⤵
                              PID:3420
                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1788 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
                              2⤵
                                PID:3568
                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=2068 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:8
                                2⤵
                                  PID:3752
                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --mojo-platform-channel-handle=2412 --field-trial-handle=1192,i,10915237838638077677,1732509648687436955,131072 /prefetch:1
                                  2⤵
                                    PID:3900
                                • C:\Windows\system32\taskeng.exe
                                  taskeng.exe {07FF166D-B0E5-4496-97E5-AB897FE0B648} S-1-5-21-3385717845-2518323428-350143044-1000:SABDUHNY\Admin:Interactive:[1]
                                  1⤵
                                    PID:2268
                                    • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                                      C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate --autoupdaterequesttype=automatic --autoupdateoperaversion=95.0.4635.37 --newautoupdaterlogic
                                      2⤵
                                      • Executes dropped EXE
                                      PID:2740
                                      • C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe
                                        "C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version
                                        3⤵
                                          PID:4060

                                    Network

                                    MITRE ATT&CK Enterprise v6

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_96EEC010953ED454BBCDFA69FC071E7C
                                      Filesize

                                      1KB

                                      MD5

                                      5a6fe73032a0dfaceb718b2476296055

                                      SHA1

                                      320bbefd838cd129e200c5de0c907d5e740d5246

                                      SHA256

                                      d4390d599eb397ccb19f1da4954d2cb1211de9c699145867f0734b996e4d2e55

                                      SHA512

                                      44789c7a8380231fd200485005c92d9f81f36b5dbde380627056e4b19d686f4ebbf2ba8969ac8f5db4791a39dafe8b5e7e861969e6b8591c30303161bf52ac1c

                                      Download Submit

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4B3D1CD03E2BE9D4F9CDDE390F5EFE31_3FCD50102D92ED08DE4C9D9CF4E45CC0
                                      Filesize

                                      1KB

                                      MD5

                                      1b8db2bc5634b430166e882520f1e0e2

                                      SHA1

                                      325089a7387233edfea148eb0fca66d788a03923

                                      SHA256

                                      58c3e23065f7fd1e5d0e145b1d870dbe82e7fa1bea7cd73fc29e99a1c7cdf6ed

                                      SHA512

                                      5c111beb6a7cfc40faf5b3390c666e1d5282e32241cd83ba3708104e398db500930bad1a2bd16af2179a50b0d2516c1650ea961958f8109c45e76562aa2aa93a

                                      Download Submit

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                                      Filesize

                                      61KB

                                      MD5

                                      fc4666cbca561e864e7fdf883a9e6661

                                      SHA1

                                      2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

                                      SHA256

                                      10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

                                      SHA512

                                      c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

                                      Download Submit

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
                                      Filesize

                                      471B

                                      MD5

                                      768442d462ac05b2b067e29de259d4d1

                                      SHA1

                                      ed7bb70009e7e749bc4e633ceb1c92d14edd3de4

                                      SHA256

                                      307b4d6cfc9873c20b7c4a22153fc45572034799637aefb26e7c0ae6a82f8ce9

                                      SHA512

                                      e63f4bb98becf62c427a75a98e076bdd15303c069175e550f7203309ce09eb1bf000d8d73cb235dcf0c87b5e2f7f5dcb12aef276d0b1c1e9a5a0e54130dfbec2

                                      Download Submit

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
                                      Filesize

                                      1KB

                                      MD5

                                      a266bb7dcc38a562631361bbf61dd11b

                                      SHA1

                                      3b1efd3a66ea28b16697394703a72ca340a05bd5

                                      SHA256

                                      df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                                      SHA512

                                      0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                                      Download Submit

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_96EEC010953ED454BBCDFA69FC071E7C
                                      Filesize

                                      516B

                                      MD5

                                      614e7594cf204e1f7466eba9af269aac

                                      SHA1

                                      730767cf007fe4e033b312a7bcc67fc56c0219cc

                                      SHA256

                                      69e786ac93a9df956aa7e0e6d0e656cbcb9815d97074ec09222b65a70da78c4f

                                      SHA512

                                      1624ae8c61e7e54550b7a0a37830cd8d40e2fc577b64928fde122ed2c8517e65366dadd3bffa56e9d61a58139dc732b2ae9a23dcfb22deaa99b2cbaf151d4dff

                                      Download Submit

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4B3D1CD03E2BE9D4F9CDDE390F5EFE31_3FCD50102D92ED08DE4C9D9CF4E45CC0
                                      Filesize

                                      524B

                                      MD5

                                      788807d624442e4469f8da2a78174a3d

                                      SHA1

                                      c2d67d36f36106726aa38684c3d8b3feea319b23

                                      SHA256

                                      d5fd94974101e7ebd6d1d924dd51b8befc1a90378fc6fbcc2eaeaf27402da70f

                                      SHA512

                                      716fafe864fa5bfdb0d063a5009c8b5de064600d9cd06bff92e6aa4202825768d4b5ed460c16c389bab6865787c334ed942b8095d56eabe574612332933ddc6c

                                      Download Submit

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
                                      Filesize

                                      438B

                                      MD5

                                      b367055ab846f0198b69e5ebffdf8a3f

                                      SHA1

                                      4376d761d33a6990789541511bb127e03fdc3012

                                      SHA256

                                      7f5d185c5f50fc8cfa4f12a32cd3454e42e1f0c938304c5e0be16614f2767f30

                                      SHA512

                                      2232e309b98e12b6797c214aeee703ede655eb82ba85e2754fd002c81687fe5979c4a9f4730cc94f0198d6257bacec805ae6eb0c39a662169e69e63cf745d49a

                                      Download Submit

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                      Filesize

                                      342B

                                      MD5

                                      6d3c7e52ebd17bcb5a19d24d963b7bec

                                      SHA1

                                      3d3bc8e13a114e803327b4c106aab6e9f5a43022

                                      SHA256

                                      49f131e34b5fddf37a7dcac5f23a2e7082b1cabfa6f2ff8a3c19a92b42219380

                                      SHA512

                                      0cc5bdb3006cd54783cf6997bfe8d3169987906f1f2441d16f7657aef93f04460fc1f60ff334095a9e9412f3ffbc042d27cddbb5fc3cd9a313ab53c55966280c

                                      Download Submit

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                      Filesize

                                      342B

                                      MD5

                                      110cade9bff7c0c4034f9cee26000b4b

                                      SHA1

                                      6eadb4b40bedfafcbed5867496a24d9356ec8496

                                      SHA256

                                      a84cc5f7eb6333ebc43f1e31ce90e3d850857ff5b6022eff39385ac8cec3d9ac

                                      SHA512

                                      24fa3c6a86e8d533919db9c09878c31f962f84fe041c928ce8bdae75979117d933b4e2871ab9a7777234aba8717578de6f83c4b85bf8a63dbc4ea735c1a4b4ac

                                      Download Submit

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                      Filesize

                                      342B

                                      MD5

                                      8a559de73de31f083d7de94e25ba35b8

                                      SHA1

                                      8710afa73e78b2e4c767e5aec72808a2b98351ac

                                      SHA256

                                      427243ad118f8b53a339dd37f351d7f41bb4832c5425e6aaf96d21f6387eddbc

                                      SHA512

                                      80a10fd2cb7a838f46a1b08785db148a7eb32837afe7d15d8ee4fbd5ee2b5229b3051328713d57a6de49245552652e3af642ab3300c7b63bef44c6deb2a2ef0c

                                      Download Submit

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
                                      Filesize

                                      434B

                                      MD5

                                      42676706527d8915eb72efbfbe4bed0a

                                      SHA1

                                      324f169673506d57392e0db5c797af26ab76a1c0

                                      SHA256

                                      41511ed13f66df08e522abcaf98bab0bd4319e5a64229bbe0297756287cb76df

                                      SHA512

                                      a1e826583a2513352447678ae519ec982949e09f588f871628f2cd767399f95d7c950bdf20e59e8fa2655bbc2b7106175f84a10c3307e0d7ea4034d50cf136bd

                                      Download Submit

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                                      Filesize

                                      242B

                                      MD5

                                      ba2c6afdae70562657221a78aba5fa47

                                      SHA1

                                      8d144bb83f0d405ee77a89d2647bb5ece4058a35

                                      SHA256

                                      3ae83829deee77d9d6d27687a62f78beede16d7f1c69ca02bac6ff6c96cd0fe0

                                      SHA512

                                      e416e8e7a64bae0bdc78a3b0847a0c04accf4b884bbe8c36e61a427ec6e36fe45005528d1f70ff92c395728f53ecb4ac35fe586ef82563f9cb1f6fea59873ad3

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\try74lz\imagestore.dat
                                      Filesize

                                      775B

                                      MD5

                                      d5bf95eb4c836a9269998a30f8ca4861

                                      SHA1

                                      04f93fbf35618d30fd5b7896087a8e72da3cc71a

                                      SHA256

                                      a4fd8e41d50e75773950c026ea335e4613ccc50132db42d360cff2e6ee3c6abd

                                      SHA512

                                      0cee9db65f6b0afdebb02e7445813be135ac3c0fe092d5d166223cbdd875b3e9b246cc6504e89c816da6f339e55d44f8a8d742537536fd807dc51cb0b5483f25

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X8FNYYS1\TLauncher-2.871-Installer-1.0.6-global.exe
                                      Filesize

                                      23.6MB

                                      MD5

                                      7a4472a78d0651e11d20aa08e43cc045

                                      SHA1

                                      aab1d5f80d7399ae2c1982201733be7681d100b1

                                      SHA256

                                      318df7404e6c4d5538a6d31997b95af52bbb8d40caf5553b3cbd9b1bc4f6db96

                                      SHA512

                                      c152c9d21b0615548173dcc61accb1a1afd5b6f98e6ec21f6a7119536397f07a54ad4087669716c3344dd338ce4f24cecf9989d472f65eaa18c87d496f23c681

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X8FNYYS1\TLauncher-2.871-Installer-1.0.6-global.exe.qf76lgh.partial
                                      Filesize

                                      23.6MB

                                      MD5

                                      7a4472a78d0651e11d20aa08e43cc045

                                      SHA1

                                      aab1d5f80d7399ae2c1982201733be7681d100b1

                                      SHA256

                                      318df7404e6c4d5538a6d31997b95af52bbb8d40caf5553b3cbd9b1bc4f6db96

                                      SHA512

                                      c152c9d21b0615548173dcc61accb1a1afd5b6f98e6ec21f6a7119536397f07a54ad4087669716c3344dd338ce4f24cecf9989d472f65eaa18c87d496f23c681

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
                                      Filesize

                                      2.7MB

                                      MD5

                                      30dd825eebf70a85cfd7da0795f8d2f5

                                      SHA1

                                      9e9a5dfaa0cdee173b3d3ec059fe59b0b73ec01a

                                      SHA256

                                      87cd64adac4201e81cf69f6b3f4b5d5cab96d9a9d5067b1bca8dd75b754e068b

                                      SHA512

                                      5615e815803099717bb5b1c840ae3c5efcae86d1ac0131fa579d9ca0e5f70b2c3e45661f7853215162280988008f12c1c718874859e73e9e1ec12cc1f2bd7d05

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                      Filesize

                                      1.8MB

                                      MD5

                                      aa4de04ccc16b74a4c2301da8d621ec1

                                      SHA1

                                      d05c6d8200f6e6b1283df82d24d687adc47d9664

                                      SHA256

                                      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                                      SHA512

                                      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                      Filesize

                                      1.8MB

                                      MD5

                                      aa4de04ccc16b74a4c2301da8d621ec1

                                      SHA1

                                      d05c6d8200f6e6b1283df82d24d687adc47d9664

                                      SHA256

                                      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                                      SHA512

                                      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                      Filesize

                                      1.3MB

                                      MD5

                                      7e08af319c9eb3297e09ca7bb8387de4

                                      SHA1

                                      4cf091f77a3eb9437ef33985e64bd10c1257284f

                                      SHA256

                                      6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                                      SHA512

                                      bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                      Filesize

                                      1.3MB

                                      MD5

                                      7e08af319c9eb3297e09ca7bb8387de4

                                      SHA1

                                      4cf091f77a3eb9437ef33985e64bd10c1257284f

                                      SHA256

                                      6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                                      SHA512

                                      bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
                                      Filesize

                                      326KB

                                      MD5

                                      80d93d38badecdd2b134fe4699721223

                                      SHA1

                                      e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                      SHA256

                                      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                      SHA512

                                      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                      Filesize

                                      1.3MB

                                      MD5

                                      e801c5847f5f9d207db53aaaf5c6f3a2

                                      SHA1

                                      8e6818ce66555e2cca92e5c5f32551fb4a91645e

                                      SHA256

                                      196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                                      SHA512

                                      303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                      Filesize

                                      1.3MB

                                      MD5

                                      e801c5847f5f9d207db53aaaf5c6f3a2

                                      SHA1

                                      8e6818ce66555e2cca92e5c5f32551fb4a91645e

                                      SHA256

                                      196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                                      SHA512

                                      303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
                                      Filesize

                                      326KB

                                      MD5

                                      80d93d38badecdd2b134fe4699721223

                                      SHA1

                                      e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                      SHA256

                                      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                      SHA512

                                      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                      Filesize

                                      2.7MB

                                      MD5

                                      30dd825eebf70a85cfd7da0795f8d2f5

                                      SHA1

                                      9e9a5dfaa0cdee173b3d3ec059fe59b0b73ec01a

                                      SHA256

                                      87cd64adac4201e81cf69f6b3f4b5d5cab96d9a9d5067b1bca8dd75b754e068b

                                      SHA512

                                      5615e815803099717bb5b1c840ae3c5efcae86d1ac0131fa579d9ca0e5f70b2c3e45661f7853215162280988008f12c1c718874859e73e9e1ec12cc1f2bd7d05

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                      Filesize

                                      2.7MB

                                      MD5

                                      30dd825eebf70a85cfd7da0795f8d2f5

                                      SHA1

                                      9e9a5dfaa0cdee173b3d3ec059fe59b0b73ec01a

                                      SHA256

                                      87cd64adac4201e81cf69f6b3f4b5d5cab96d9a9d5067b1bca8dd75b754e068b

                                      SHA512

                                      5615e815803099717bb5b1c840ae3c5efcae86d1ac0131fa579d9ca0e5f70b2c3e45661f7853215162280988008f12c1c718874859e73e9e1ec12cc1f2bd7d05

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                      Filesize

                                      2.7MB

                                      MD5

                                      30dd825eebf70a85cfd7da0795f8d2f5

                                      SHA1

                                      9e9a5dfaa0cdee173b3d3ec059fe59b0b73ec01a

                                      SHA256

                                      87cd64adac4201e81cf69f6b3f4b5d5cab96d9a9d5067b1bca8dd75b754e068b

                                      SHA512

                                      5615e815803099717bb5b1c840ae3c5efcae86d1ac0131fa579d9ca0e5f70b2c3e45661f7853215162280988008f12c1c718874859e73e9e1ec12cc1f2bd7d05

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                      Filesize

                                      2.7MB

                                      MD5

                                      30dd825eebf70a85cfd7da0795f8d2f5

                                      SHA1

                                      9e9a5dfaa0cdee173b3d3ec059fe59b0b73ec01a

                                      SHA256

                                      87cd64adac4201e81cf69f6b3f4b5d5cab96d9a9d5067b1bca8dd75b754e068b

                                      SHA512

                                      5615e815803099717bb5b1c840ae3c5efcae86d1ac0131fa579d9ca0e5f70b2c3e45661f7853215162280988008f12c1c718874859e73e9e1ec12cc1f2bd7d05

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
                                      Filesize

                                      602B

                                      MD5

                                      f8aed99d48225dcc08bb135caf26ebe3

                                      SHA1

                                      40e695e4b6d5b51bfee7bfa6c363d54077d000af

                                      SHA256

                                      c0e2858d6fd821abd17a20140dc2ea50b6e6d5fe172fd70cbb3dba37dcf49713

                                      SHA512

                                      f04e2afe5af28909b6033f152dbf5f1c2527f304898eeb469c23840eeb5eb063807ba38d1021276e38d856e906c70195096068b12af47122f818fc14b7f50b3d

                                      Download Submit

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\68WGK1W3.txt
                                      Filesize

                                      604B

                                      MD5

                                      e31f03b7e5f27d0369204e18ec18803d

                                      SHA1

                                      1f1bcf7eebe8516afa2dd8a8194870c4f3a1152f

                                      SHA256

                                      df03e029b366fdee345ee84e22e4b55f2eb0f76be14c2702df59f83458c4a60e

                                      SHA512

                                      a066f83b58b8bf2f4716da955c9e44e1cf3e8960d54efcb251fb2c8d4cdd5b1d07a775dafe74fecf6b5e312a64cdae937837cc4df39e8aa705e021dbdd8edf1e

                                      Download Submit

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EA8C5D7I.txt
                                      Filesize

                                      242B

                                      MD5

                                      3aea66a63bc6474d7dd5d77605de2513

                                      SHA1

                                      56be1c867bd39862c294d6021f6c40a97f90cf1b

                                      SHA256

                                      c8c3846e3c52b646d4e4d2b7b9bb31f2774f7ff2a9336b258853d43ec72f2a05

                                      SHA512

                                      ab83f6110f2dd629f7d392a61035261f975a425e25fdcbfaa3aa823e510c60c2dfcb5131a0f2db744fa8a87f994a00e629a25ea2d41505215f61b422dd53ab17

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X8FNYYS1\TLauncher-2.871-Installer-1.0.6-global.exe
                                      Filesize

                                      23.6MB

                                      MD5

                                      7a4472a78d0651e11d20aa08e43cc045

                                      SHA1

                                      aab1d5f80d7399ae2c1982201733be7681d100b1

                                      SHA256

                                      318df7404e6c4d5538a6d31997b95af52bbb8d40caf5553b3cbd9b1bc4f6db96

                                      SHA512

                                      c152c9d21b0615548173dcc61accb1a1afd5b6f98e6ec21f6a7119536397f07a54ad4087669716c3344dd338ce4f24cecf9989d472f65eaa18c87d496f23c681

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X8FNYYS1\TLauncher-2.871-Installer-1.0.6-global.exe
                                      Filesize

                                      23.6MB

                                      MD5

                                      7a4472a78d0651e11d20aa08e43cc045

                                      SHA1

                                      aab1d5f80d7399ae2c1982201733be7681d100b1

                                      SHA256

                                      318df7404e6c4d5538a6d31997b95af52bbb8d40caf5553b3cbd9b1bc4f6db96

                                      SHA512

                                      c152c9d21b0615548173dcc61accb1a1afd5b6f98e6ec21f6a7119536397f07a54ad4087669716c3344dd338ce4f24cecf9989d472f65eaa18c87d496f23c681

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
                                      Filesize

                                      2.7MB

                                      MD5

                                      30dd825eebf70a85cfd7da0795f8d2f5

                                      SHA1

                                      9e9a5dfaa0cdee173b3d3ec059fe59b0b73ec01a

                                      SHA256

                                      87cd64adac4201e81cf69f6b3f4b5d5cab96d9a9d5067b1bca8dd75b754e068b

                                      SHA512

                                      5615e815803099717bb5b1c840ae3c5efcae86d1ac0131fa579d9ca0e5f70b2c3e45661f7853215162280988008f12c1c718874859e73e9e1ec12cc1f2bd7d05

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\Opera_installer_2302131204570622144.dll
                                      Filesize

                                      4.6MB

                                      MD5

                                      5ff9275c5cee292fff9034f03bd847e1

                                      SHA1

                                      37bf88e062278882492823c7039b7cf374756ae0

                                      SHA256

                                      2309501e723a011f4bf2b505e178cbb97af4d798a8720d344f2730c4d756ee08

                                      SHA512

                                      f58e5981e25cd6cdd5edb9d9974f137615dee7516d221bf0df08a7425ec68361f29d7b5ca1b835c476fcbcee0df4a028bfa5308867fb3976aaba67cbf8b8dd02

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\Opera_installer_2302131204574362224.dll
                                      Filesize

                                      4.6MB

                                      MD5

                                      5ff9275c5cee292fff9034f03bd847e1

                                      SHA1

                                      37bf88e062278882492823c7039b7cf374756ae0

                                      SHA256

                                      2309501e723a011f4bf2b505e178cbb97af4d798a8720d344f2730c4d756ee08

                                      SHA512

                                      f58e5981e25cd6cdd5edb9d9974f137615dee7516d221bf0df08a7425ec68361f29d7b5ca1b835c476fcbcee0df4a028bfa5308867fb3976aaba67cbf8b8dd02

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\Opera_installer_2302131204599642336.dll
                                      Filesize

                                      4.6MB

                                      MD5

                                      5ff9275c5cee292fff9034f03bd847e1

                                      SHA1

                                      37bf88e062278882492823c7039b7cf374756ae0

                                      SHA256

                                      2309501e723a011f4bf2b505e178cbb97af4d798a8720d344f2730c4d756ee08

                                      SHA512

                                      f58e5981e25cd6cdd5edb9d9974f137615dee7516d221bf0df08a7425ec68361f29d7b5ca1b835c476fcbcee0df4a028bfa5308867fb3976aaba67cbf8b8dd02

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                      Filesize

                                      1.8MB

                                      MD5

                                      aa4de04ccc16b74a4c2301da8d621ec1

                                      SHA1

                                      d05c6d8200f6e6b1283df82d24d687adc47d9664

                                      SHA256

                                      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                                      SHA512

                                      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                      Filesize

                                      1.8MB

                                      MD5

                                      aa4de04ccc16b74a4c2301da8d621ec1

                                      SHA1

                                      d05c6d8200f6e6b1283df82d24d687adc47d9664

                                      SHA256

                                      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                                      SHA512

                                      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                      Filesize

                                      1.8MB

                                      MD5

                                      aa4de04ccc16b74a4c2301da8d621ec1

                                      SHA1

                                      d05c6d8200f6e6b1283df82d24d687adc47d9664

                                      SHA256

                                      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                                      SHA512

                                      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                      Filesize

                                      1.8MB

                                      MD5

                                      aa4de04ccc16b74a4c2301da8d621ec1

                                      SHA1

                                      d05c6d8200f6e6b1283df82d24d687adc47d9664

                                      SHA256

                                      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                                      SHA512

                                      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                      Filesize

                                      1.8MB

                                      MD5

                                      aa4de04ccc16b74a4c2301da8d621ec1

                                      SHA1

                                      d05c6d8200f6e6b1283df82d24d687adc47d9664

                                      SHA256

                                      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                                      SHA512

                                      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                      Filesize

                                      1.8MB

                                      MD5

                                      aa4de04ccc16b74a4c2301da8d621ec1

                                      SHA1

                                      d05c6d8200f6e6b1283df82d24d687adc47d9664

                                      SHA256

                                      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                                      SHA512

                                      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
                                      Filesize

                                      1.7MB

                                      MD5

                                      1bbf5dd0b6ca80e4c7c77495c3f33083

                                      SHA1

                                      e0520037e60eb641ec04d1e814394c9da0a6a862

                                      SHA256

                                      bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

                                      SHA512

                                      97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
                                      Filesize

                                      97KB

                                      MD5

                                      da1d0cd400e0b6ad6415fd4d90f69666

                                      SHA1

                                      de9083d2902906cacf57259cf581b1466400b799

                                      SHA256

                                      7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

                                      SHA512

                                      f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                      Filesize

                                      1.3MB

                                      MD5

                                      7e08af319c9eb3297e09ca7bb8387de4

                                      SHA1

                                      4cf091f77a3eb9437ef33985e64bd10c1257284f

                                      SHA256

                                      6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                                      SHA512

                                      bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                      Filesize

                                      1.3MB

                                      MD5

                                      7e08af319c9eb3297e09ca7bb8387de4

                                      SHA1

                                      4cf091f77a3eb9437ef33985e64bd10c1257284f

                                      SHA256

                                      6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                                      SHA512

                                      bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                      Filesize

                                      1.3MB

                                      MD5

                                      7e08af319c9eb3297e09ca7bb8387de4

                                      SHA1

                                      4cf091f77a3eb9437ef33985e64bd10c1257284f

                                      SHA256

                                      6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                                      SHA512

                                      bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                      Filesize

                                      1.3MB

                                      MD5

                                      7e08af319c9eb3297e09ca7bb8387de4

                                      SHA1

                                      4cf091f77a3eb9437ef33985e64bd10c1257284f

                                      SHA256

                                      6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                                      SHA512

                                      bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                      Filesize

                                      1.3MB

                                      MD5

                                      7e08af319c9eb3297e09ca7bb8387de4

                                      SHA1

                                      4cf091f77a3eb9437ef33985e64bd10c1257284f

                                      SHA256

                                      6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                                      SHA512

                                      bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
                                      Filesize

                                      326KB

                                      MD5

                                      80d93d38badecdd2b134fe4699721223

                                      SHA1

                                      e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                      SHA256

                                      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                      SHA512

                                      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                      Filesize

                                      1.3MB

                                      MD5

                                      e801c5847f5f9d207db53aaaf5c6f3a2

                                      SHA1

                                      8e6818ce66555e2cca92e5c5f32551fb4a91645e

                                      SHA256

                                      196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                                      SHA512

                                      303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                      Filesize

                                      1.3MB

                                      MD5

                                      e801c5847f5f9d207db53aaaf5c6f3a2

                                      SHA1

                                      8e6818ce66555e2cca92e5c5f32551fb4a91645e

                                      SHA256

                                      196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                                      SHA512

                                      303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                      Filesize

                                      1.3MB

                                      MD5

                                      e801c5847f5f9d207db53aaaf5c6f3a2

                                      SHA1

                                      8e6818ce66555e2cca92e5c5f32551fb4a91645e

                                      SHA256

                                      196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                                      SHA512

                                      303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                      Filesize

                                      1.3MB

                                      MD5

                                      e801c5847f5f9d207db53aaaf5c6f3a2

                                      SHA1

                                      8e6818ce66555e2cca92e5c5f32551fb4a91645e

                                      SHA256

                                      196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                                      SHA512

                                      303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                      Filesize

                                      1.3MB

                                      MD5

                                      e801c5847f5f9d207db53aaaf5c6f3a2

                                      SHA1

                                      8e6818ce66555e2cca92e5c5f32551fb4a91645e

                                      SHA256

                                      196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                                      SHA512

                                      303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
                                      Filesize

                                      326KB

                                      MD5

                                      80d93d38badecdd2b134fe4699721223

                                      SHA1

                                      e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                      SHA256

                                      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                      SHA512

                                      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                      Filesize

                                      2.7MB

                                      MD5

                                      30dd825eebf70a85cfd7da0795f8d2f5

                                      SHA1

                                      9e9a5dfaa0cdee173b3d3ec059fe59b0b73ec01a

                                      SHA256

                                      87cd64adac4201e81cf69f6b3f4b5d5cab96d9a9d5067b1bca8dd75b754e068b

                                      SHA512

                                      5615e815803099717bb5b1c840ae3c5efcae86d1ac0131fa579d9ca0e5f70b2c3e45661f7853215162280988008f12c1c718874859e73e9e1ec12cc1f2bd7d05

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                      Filesize

                                      2.7MB

                                      MD5

                                      30dd825eebf70a85cfd7da0795f8d2f5

                                      SHA1

                                      9e9a5dfaa0cdee173b3d3ec059fe59b0b73ec01a

                                      SHA256

                                      87cd64adac4201e81cf69f6b3f4b5d5cab96d9a9d5067b1bca8dd75b754e068b

                                      SHA512

                                      5615e815803099717bb5b1c840ae3c5efcae86d1ac0131fa579d9ca0e5f70b2c3e45661f7853215162280988008f12c1c718874859e73e9e1ec12cc1f2bd7d05

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                      Filesize

                                      2.7MB

                                      MD5

                                      30dd825eebf70a85cfd7da0795f8d2f5

                                      SHA1

                                      9e9a5dfaa0cdee173b3d3ec059fe59b0b73ec01a

                                      SHA256

                                      87cd64adac4201e81cf69f6b3f4b5d5cab96d9a9d5067b1bca8dd75b754e068b

                                      SHA512

                                      5615e815803099717bb5b1c840ae3c5efcae86d1ac0131fa579d9ca0e5f70b2c3e45661f7853215162280988008f12c1c718874859e73e9e1ec12cc1f2bd7d05

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                      Filesize

                                      2.7MB

                                      MD5

                                      30dd825eebf70a85cfd7da0795f8d2f5

                                      SHA1

                                      9e9a5dfaa0cdee173b3d3ec059fe59b0b73ec01a

                                      SHA256

                                      87cd64adac4201e81cf69f6b3f4b5d5cab96d9a9d5067b1bca8dd75b754e068b

                                      SHA512

                                      5615e815803099717bb5b1c840ae3c5efcae86d1ac0131fa579d9ca0e5f70b2c3e45661f7853215162280988008f12c1c718874859e73e9e1ec12cc1f2bd7d05

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                      Filesize

                                      2.7MB

                                      MD5

                                      30dd825eebf70a85cfd7da0795f8d2f5

                                      SHA1

                                      9e9a5dfaa0cdee173b3d3ec059fe59b0b73ec01a

                                      SHA256

                                      87cd64adac4201e81cf69f6b3f4b5d5cab96d9a9d5067b1bca8dd75b754e068b

                                      SHA512

                                      5615e815803099717bb5b1c840ae3c5efcae86d1ac0131fa579d9ca0e5f70b2c3e45661f7853215162280988008f12c1c718874859e73e9e1ec12cc1f2bd7d05

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                      Filesize

                                      2.7MB

                                      MD5

                                      30dd825eebf70a85cfd7da0795f8d2f5

                                      SHA1

                                      9e9a5dfaa0cdee173b3d3ec059fe59b0b73ec01a

                                      SHA256

                                      87cd64adac4201e81cf69f6b3f4b5d5cab96d9a9d5067b1bca8dd75b754e068b

                                      SHA512

                                      5615e815803099717bb5b1c840ae3c5efcae86d1ac0131fa579d9ca0e5f70b2c3e45661f7853215162280988008f12c1c718874859e73e9e1ec12cc1f2bd7d05

                                      Download Submit

                                    • memory/872-138-0x0000000000050000-0x0000000000438000-memory.dmp

                                      Filesize

                                      3.9MB

                                      Download

                                    • memory/872-161-0x0000000002C10000-0x0000000002C20000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/872-99-0x0000000002C10000-0x0000000002C20000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/872-80-0x0000000000950000-0x0000000000953000-memory.dmp

                                      Filesize

                                      12KB

                                      Download

                                    • memory/872-79-0x0000000010000000-0x0000000010051000-memory.dmp

                                      Filesize

                                      324KB

                                      Download

                                    • memory/872-75-0x0000000000050000-0x0000000000438000-memory.dmp

                                      Filesize

                                      3.9MB

                                      Download

                                    • memory/908-207-0x0000000002030000-0x0000000003030000-memory.dmp

                                      Filesize

                                      16.0MB

                                      Download

                                    • memory/1044-72-0x0000000002B30000-0x0000000002F18000-memory.dmp

                                      Filesize

                                      3.9MB

                                      Download

                                    • memory/1044-74-0x0000000002B30000-0x0000000002F18000-memory.dmp

                                      Filesize

                                      3.9MB

                                      Download

                                    • memory/1044-73-0x0000000002B30000-0x0000000002F18000-memory.dmp

                                      Filesize

                                      3.9MB

                                      Download

                                    • memory/1044-71-0x0000000002B30000-0x0000000002F18000-memory.dmp

                                      Filesize

                                      3.9MB

                                      Download

                                    • memory/1044-60-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/1312-101-0x0000000002DF0000-0x00000000031D8000-memory.dmp

                                      Filesize

                                      3.9MB

                                      Download

                                    • memory/1312-102-0x0000000002DF0000-0x00000000031D8000-memory.dmp

                                      Filesize

                                      3.9MB

                                      Download

                                    • memory/1652-120-0x0000000002110000-0x0000000002120000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/1652-136-0x0000000000320000-0x0000000000708000-memory.dmp

                                      Filesize

                                      3.9MB

                                      Download

                                    • memory/1652-123-0x0000000005B00000-0x0000000006047000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/1652-125-0x0000000005B00000-0x0000000006047000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/1652-124-0x0000000005B00000-0x0000000006047000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/1652-104-0x0000000000320000-0x0000000000708000-memory.dmp

                                      Filesize

                                      3.9MB

                                      Download

                                    • memory/2144-168-0x00000000034E0000-0x0000000003A27000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2144-154-0x00000000038E0000-0x0000000003E27000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2144-140-0x00000000029D0000-0x0000000002F17000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2144-139-0x0000000000400000-0x0000000000947000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2144-200-0x0000000000400000-0x0000000000947000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2224-205-0x0000000000400000-0x0000000000947000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2224-141-0x0000000000400000-0x0000000000947000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2336-147-0x0000000000400000-0x0000000000947000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2384-156-0x0000000000400000-0x0000000000947000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2384-159-0x0000000002810000-0x0000000002D57000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2384-183-0x0000000000400000-0x0000000000947000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2384-169-0x0000000000400000-0x0000000000947000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2472-191-0x0000000000400000-0x0000000000947000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2472-160-0x0000000000400000-0x0000000000947000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2752-171-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/2920-206-0x0000000002A20000-0x0000000002A30000-memory.dmp

                                      Filesize

                                      64KB

                                      Download