Analysis
-
max time kernel
1200s -
max time network
1203s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
17-07-2024 13:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://sites.google.com/view/wdawdawdqe23123/home
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
https://sites.google.com/view/wdawdawdqe23123/home
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
https://sites.google.com/view/wdawdawdqe23123/home
Resource
win11-20240709-en
General
-
Target
https://sites.google.com/view/wdawdawdqe23123/home
Malware Config
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
resource yara_rule behavioral3/memory/5364-1776-0x0000000000920000-0x00000000009C2000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Blocklisted process makes network request 1 IoCs
flow pid Process 140 3188 rundll32.exe -
pid Process 952 powershell.exe 2068 powershell.exe 4644 powershell.exe 1916 powershell.exe 5288 powershell.exe 4216 powershell.EXE 4880 powershell.exe -
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion NNRaWlSuztxFkBux.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\International\Geo\Nation xJvChqb.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hide.me VPN.lnk Hide.me-Setup-4.1.2.tmp File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hide.me VPN.lnk Hide.me.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hide.me VPN.lnk Hide.me.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 64 IoCs
pid Process 5892 setup_Ot4AI2mJd6.tmp 4616 videomachine32.exe 4320 cINXK8h3siB1IdjEdc.exe 1004 cINXK8h3siB1IdjEdc.tmp 4840 Tupx4FYzVHvOprhfeXU.exe 2648 concertplayerfree32.exe 5364 concertplayerfree32.exe 4936 NNRaWlSuztxFkBux.exe 1384 POmK4zzYzf99JwX8Sbfm.exe 1684 setup.exe 3384 setup.exe 1100 setup.exe 3972 setup.exe 5436 setup.exe 5300 NNRaWlSuztxFkBux.exe 4388 Assistant_111.0.5168.25_Setup.exe_sfx.exe 1180 xJvChqb.exe 4048 assistant_installer.exe 4264 assistant_installer.exe 2920 installer.exe 4820 installer.exe 5348 assistant_installer.exe 4148 assistant_installer.exe 1912 assistant_installer.exe 6000 assistant_installer.exe 2636 browser_assistant.exe 4940 opera.exe 4588 opera_crashreporter.exe 1792 opera.exe 780 opera_crashreporter.exe 2408 opera.exe 2052 opera.exe 4684 opera.exe 6136 opera.exe 3860 opera_crashreporter.exe 1968 opera.exe 8 opera_crashreporter.exe 2932 opera.exe 5524 opera.exe 3564 opera.exe 3492 opera.exe 2876 opera.exe 5124 opera.exe 5072 opera.exe 4484 opera.exe 3556 opera.exe 1836 opera_gx_splash.exe 980 opera.exe 1592 opera.exe 5556 opera.exe 5752 opera.exe 1284 opera.exe 5644 opera.exe 4644 opera.exe 1440 opera.exe 6552 opera.exe 6568 opera.exe 6152 opera.exe 6164 opera.exe 6176 opera.exe 3900 installer.exe 3956 opera.exe 2072 opera.exe 2720 opera.exe -
Loads dropped DLL 64 IoCs
pid Process 5892 setup_Ot4AI2mJd6.tmp 5892 setup_Ot4AI2mJd6.tmp 5892 setup_Ot4AI2mJd6.tmp 1004 cINXK8h3siB1IdjEdc.tmp 4840 Tupx4FYzVHvOprhfeXU.exe 4840 Tupx4FYzVHvOprhfeXU.exe 4840 Tupx4FYzVHvOprhfeXU.exe 4840 Tupx4FYzVHvOprhfeXU.exe 4840 Tupx4FYzVHvOprhfeXU.exe 4840 Tupx4FYzVHvOprhfeXU.exe 4840 Tupx4FYzVHvOprhfeXU.exe 4840 Tupx4FYzVHvOprhfeXU.exe 4840 Tupx4FYzVHvOprhfeXU.exe 1684 setup.exe 3384 setup.exe 1100 setup.exe 3972 setup.exe 5436 setup.exe 4048 assistant_installer.exe 4048 assistant_installer.exe 4264 assistant_installer.exe 4264 assistant_installer.exe 3188 rundll32.exe 2920 installer.exe 4820 installer.exe 5348 assistant_installer.exe 5348 assistant_installer.exe 4148 assistant_installer.exe 4148 assistant_installer.exe 1912 assistant_installer.exe 1912 assistant_installer.exe 6000 assistant_installer.exe 6000 assistant_installer.exe 2636 browser_assistant.exe 2636 browser_assistant.exe 4940 opera.exe 4940 opera.exe 1792 opera.exe 1792 opera.exe 2408 opera.exe 2052 opera.exe 2408 opera.exe 2052 opera.exe 2408 opera.exe 2408 opera.exe 2408 opera.exe 4684 opera.exe 2408 opera.exe 2408 opera.exe 2408 opera.exe 4684 opera.exe 6136 opera.exe 6136 opera.exe 1968 opera.exe 1968 opera.exe 2932 opera.exe 2932 opera.exe 5524 opera.exe 5524 opera.exe 3564 opera.exe 5524 opera.exe 5524 opera.exe 5524 opera.exe 3492 opera.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 45.155.250.90 -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Windows\CurrentVersion\Run\Opera Stable = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe" opera.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Windows\CurrentVersion\Run\Snetchball = "C:\\Users\\Admin\\AppData\\Roaming\\Snetchball\\Snetchball.exe" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{185963d2-4c1e-4ef1-a6a4-5219e12fb512} = "\"C:\\ProgramData\\Package Cache\\{185963d2-4c1e-4ef1-a6a4-5219e12fb512}\\windowsdesktop-runtime-6.0.26-win-x86.exe\" /burn.runonce" windowsdesktop-runtime-6.0.26-win-x86.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Windows\CurrentVersion\Run\Opera Browser Assistant = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\assistant\\browser_assistant.exe" assistant_installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Windows\CurrentVersion\Run\Opera Stable = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe" opera.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipilpceecbhfpflneijogboalilnfjp\1.3.3_0\manifest.json xJvChqb.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json xJvChqb.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini xJvChqb.exe -
Enumerates connected drives 3 TTPs 29 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\F: setup.exe File opened (read-only) \??\D: setup.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: installer.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\D: setup.exe File opened (read-only) \??\F: setup.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
flow ioc 2 drive.google.com 4 sites.google.com 7 sites.google.com 8 sites.google.com 26 drive.google.com 304 sites.google.com 331 sites.google.com 1 sites.google.com -
Checks system information in the registry 2 TTPs 3 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName opera.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName opera.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer opera.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\{11a57686-7ca0-f148-831d-0ab24b9d67b0}\SETB1DC.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\netbc63a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\net44amd.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_35bbbe80dec15683\netnvm64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\netl1c63x64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\netmlx4eth63.PNF MsiExec.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_1fab0fd8cb4d7dee\netwmbclass.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\netwns64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_97cd1a72c2a7829c\netrtwlans.PNF MsiExec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_206e9e544d84356f\ndisimplatformmp.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\rtucx21x64.inf_amd64_d70642620058e2a4\rtucx21x64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\netathr10x.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_07fc330c5a5730ca\mrvlpcie8897.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_54eacac1858c78ab\nett4x64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_895623810c19146a\nete1e3e.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\netwtw06.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\Temp\{1631bc21-ffa1-af48-b38a-70aba3cc36dc}\SETBE41.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\netjme.PNF MsiExec.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 xJvChqb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199 xJvChqb.exe File created C:\Windows\System32\DriverStore\FileRepository\netwsw00.inf_amd64_24d55504ae3587aa\netwsw00.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_b98aa91c766be0ea\netavpna.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netbxnd0a.inf_amd64_777881a2c4c0272c\netbxnd0a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\net8185.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\netr28x.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{11a57686-7ca0-f148-831d-0ab24b9d67b0}\ovpn-dco.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\net819xp.inf_amd64_ff7a5dd4f9b1ceba\net819xp.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\netmyk64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_f1efe88b4f90c639\netax88772.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\rtwlanu_oldic.inf_amd64_1a82423cc076e882\rtwlanu_oldic.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1631bc21-ffa1-af48-b38a-70aba3cc36dc}\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\tap0901.sys DrvInst.exe File created C:\Windows\system32\GroupPolicy\gpt.ini NNRaWlSuztxFkBux.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{11a57686-7ca0-f148-831d-0ab24b9d67b0}\SETB1EC.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_178f1bdb49a6e2fd\net7800-x64-n650f.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1ed57daf97af7063\netrasa.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\net7400-x64-n650.inf_amd64_557ce3b37c3e0e3b\net7400-x64-n650.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1631bc21-ffa1-af48-b38a-70aba3cc36dc} DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{11a57686-7ca0-f148-831d-0ab24b9d67b0}\SETB1ED.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1631bc21-ffa1-af48-b38a-70aba3cc36dc}\SETBE51.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_32201FF65E9A20A693462A3946A29CAE xJvChqb.exe File created C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_1e173acb8f2f340f\net1ic64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\netg664.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{11a57686-7ca0-f148-831d-0ab24b9d67b0}\SETB1DC.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_e0bae6831f60ea5f\bcmdhd64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_7080f6b8ea1744fb\netnvma.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\netwew00.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_04b60d124553a40f\rndiscmp.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_bc859d32f3e2f0d5\net8187bv64.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{11a57686-7ca0-f148-831d-0ab24b9d67b0}\ovpn-dco.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{11a57686-7ca0-f148-831d-0ab24b9d67b0} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_7aeb3e6bfcb2f0f1\netmlx5.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_7830581a689ef40d\netefe3e.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_6686e5d9c8b063ef\usbncm.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\netr7364.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_a31306bfdf7135b0\bthpan.PNF MsiExec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData xJvChqb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E52E4DB9468EB31D663A0754C2775A04 xJvChqb.exe File created C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\netwbw02.PNF MsiExec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\ru\ReachFramework.resources.dll msiexec.exe File created C:\Program Files (x86)\hide.me VPN\is-KUM65.tmp Hide.me-Setup-4.1.2.tmp File created C:\Program Files (x86)\hide.me VPN\OpenVPN\x64\is-02CNT.tmp Hide.me-Setup-4.1.2.tmp File created C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.26\System.Diagnostics.FileVersionInfo.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.26\System.Threading.Thread.dll msiexec.exe File created C:\Program Files (x86)\hide.me VPN\is-K3EDK.tmp Hide.me-Setup-4.1.2.tmp File opened for modification C:\Program Files (x86)\hide.me VPN\CodeKicker.BBCode.dll Hide.me-Setup-4.1.2.tmp File opened for modification C:\Program Files (x86)\hide.me VPN\Common.Json.dll Hide.me-Setup-4.1.2.tmp File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\fr\System.Windows.Forms.Design.resources.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\de\System.Windows.Forms.Design.resources.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\tr\System.Windows.Forms.resources.dll msiexec.exe File created C:\Program Files (x86)\hide.me VPN\is-ETLST.tmp Hide.me-Setup-4.1.2.tmp File created C:\Program Files (x86)\hide.me VPN\is-ID7FU.tmp Hide.me-Setup-4.1.2.tmp File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja xJvChqb.exe File opened for modification C:\Program Files (x86)\hide.me VPN\OpenVPN\x64\wintun.dll Hide.me-Setup-4.1.2.tmp File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\PresentationFramework.AeroLite.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\cs\UIAutomationClientSideProviders.resources.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.26\System.IO.Compression.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.26\api-ms-win-crt-environment-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\tr\System.Windows.Forms.Design.resources.dll msiexec.exe File opened for modification C:\Program Files (x86)\hide.me VPN\nfapi.dll Hide.me-Setup-4.1.2.tmp File opened for modification C:\Program Files (x86)\hide.me VPN\NamedPipeServerStream.NetFrameworkVersion.dll Hide.me-Setup-4.1.2.tmp File opened for modification C:\Program Files (x86)\hide.me VPN\Microsoft.Win32.SystemEvents.dll Hide.me-Setup-4.1.2.tmp File created C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.26\System.IO.Compression.Native.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.26\System.ObjectModel.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\ko\System.Windows.Forms.Primitives.resources.dll msiexec.exe File created C:\Program Files (x86)\hide.me VPN\runtimes\win\lib\net6.0\is-B6HFN.tmp Hide.me-Setup-4.1.2.tmp File opened for modification C:\Program Files (x86)\hide.me VPN\Common.Sentry.dll Hide.me-Setup-4.1.2.tmp File opened for modification C:\Program Files (x86)\hide.me VPN\vpnlib.dll Hide.me-Setup-4.1.2.tmp File created C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.26\System.IO.MemoryMappedFiles.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.26\System.Reflection.Emit.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.26\System.ComponentModel.EventBasedAsync.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\System.Security.Cryptography.ProtectedData.dll msiexec.exe File created C:\Program Files (x86)\hide.me VPN\is-3URK4.tmp Hide.me-Setup-4.1.2.tmp File created C:\Program Files (x86)\hide.me VPN\is-IDSJB.tmp Hide.me-Setup-4.1.2.tmp File created C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.26\clrjit.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\it\System.Windows.Forms.resources.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\fr\System.Windows.Forms.resources.dll msiexec.exe File created C:\Program Files (x86)\hide.me VPN\OpenVPN\x64\is-EB6HS.tmp Hide.me-Setup-4.1.2.tmp File opened for modification C:\Program Files (x86)\hide.me VPN\Microsoft.Xaml.Behaviors.dll Hide.me-Setup-4.1.2.tmp File opened for modification C:\Program Files (x86)\hide.me VPN\Newtonsoft.Json.dll Hide.me-Setup-4.1.2.tmp File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\pl\System.Xaml.resources.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\cs\System.Windows.Forms.Primitives.resources.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\D3DCompiler_47_cor3.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\es\PresentationFramework.resources.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\pl\System.Windows.Forms.Primitives.resources.dll msiexec.exe File created C:\Program Files (x86)\hide.me VPN\OpenVPN\x86\is-3K83N.tmp Hide.me-Setup-4.1.2.tmp File created C:\Program Files (x86)\rQOnGHSVU\xUgRohK.xml xJvChqb.exe File opened for modification C:\Program Files (x86)\hide.me VPN\runtimes\win\lib\net6.0\System.Management.dll Hide.me-Setup-4.1.2.tmp File opened for modification C:\Program Files (x86)\hide.me VPN\OpenVPN\x86\libssl-3.dll Hide.me-Setup-4.1.2.tmp File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\PenImc_cor3.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\fr\PresentationCore.resources.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\zh-Hant\UIAutomationClientSideProviders.resources.dll msiexec.exe File created C:\Program Files (x86)\hide.me VPN\is-7S2EJ.tmp Hide.me-Setup-4.1.2.tmp File created C:\Program Files (x86)\hide.me VPN\is-9J0UK.tmp Hide.me-Setup-4.1.2.tmp File created C:\Program Files (x86)\hide.me VPN\runtimes\win-x86\lib\net5.0\is-MDG0A.tmp Hide.me-Setup-4.1.2.tmp File opened for modification C:\Program Files (x86)\hide.me VPN\Hardcodet.NotifyIcon.Wpf.dll Hide.me-Setup-4.1.2.tmp File created C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.26\System.Runtime.CompilerServices.Unsafe.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\it\UIAutomationProvider.resources.dll msiexec.exe File created C:\Program Files (x86)\hide.me VPN\runtimes\win\lib\net6.0\is-2EB3L.tmp Hide.me-Setup-4.1.2.tmp File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\cs\Microsoft.VisualBasic.Forms.resources.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\es\ReachFramework.resources.dll msiexec.exe File created C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.26\zh-Hant\System.Xaml.resources.dll msiexec.exe File created C:\Program Files (x86)\hide.me VPN\Wireguard\x64\is-SORS4.tmp Hide.me-Setup-4.1.2.tmp -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping11108_588432205\LICENSE Snetchball.exe File created C:\Windows\SystemTemp\~DFDFD4DFAE8E025D3C.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF2075F0E3F9A6507B.TMP msiexec.exe File opened for modification C:\Windows\SystemTemp opera.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_2132715359\manifest.fingerprint opera.exe File created C:\Windows\Installer\e647796.msi msiexec.exe File created C:\Windows\SystemTemp\~DFFA04D6565A257540.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_1878141882\manifest.fingerprint opera.exe File created C:\Windows\Installer\e647792.msi msiexec.exe File created C:\Windows\SystemTemp\~DF24490AFD56CE8E4F.TMP msiexec.exe File opened for modification C:\Windows\inf\oem4.inf DrvInst.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_2078311376\_metadata\verified_contents.json opera.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_166820281\_metadata\verified_contents.json opera.exe File created C:\Windows\Installer\e64779b.msi msiexec.exe File created C:\Windows\Installer\SourceHash{C912D2DF-06E9-49D2-9CBB-96AB945AC2DC} msiexec.exe File opened for modification C:\Windows\Installer\e6477a1.msi msiexec.exe File created C:\Windows\SystemTemp\~DFA1867BD62E77E8C4.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{1BCFF523-F68B-4E85-AB83-FF03A3AC041A} msiexec.exe File created C:\Windows\SystemTemp\scoped_dir1968_1761910911\persona.ini opera.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_166820281\_platform_specific\win_x64\widevinecdm.dll.sig opera.exe File created C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping11108_588432205\_platform_specific\win_x86\widevinecdm.dll Snetchball.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI7FE0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8129.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF051DDF8BC4E45967.TMP msiexec.exe File opened for modification C:\Windows\Installer\e6477ab.msi msiexec.exe File created C:\Windows\Tasks\QSIFNGJKzIceSqfWs.job schtasks.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_2070204158\Google.Widevine.CDM.dll opera.exe File created C:\Windows\Installer\e6477a1.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_2078311376\manifest.json opera.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_2070204158\manifest.fingerprint opera.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_2132715359\_metadata\verified_contents.json opera.exe File created C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping11108_588432205\manifest.json Snetchball.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF2A882B82B73039BB.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF132FBC508CEF9461.TMP msiexec.exe File created C:\Windows\SystemTemp\scoped_dir1792_830877694\persona.ini opera.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_166820281\manifest.fingerprint opera.exe File opened for modification C:\Windows\SystemTemp Snetchball.exe File created C:\Windows\Installer\SourceHash{0E018729-7EC9-4539-BA27-7F010E3D4FDC} msiexec.exe File created C:\Windows\SystemTemp\~DFAE0DB9E478D03BC9.TMP msiexec.exe File created C:\Windows\Installer\e6477aa.msi msiexec.exe File created C:\Windows\Tasks\bAFePNRVjvDkkTEmWE.job schtasks.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_166820281\LICENSE opera.exe File opened for modification C:\Windows\SystemTemp Snetchball.exe File opened for modification C:\Windows\Installer\e647797.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB138.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_2070204158\_metadata\verified_contents.json opera.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_2070204158\manifest.json opera.exe File opened for modification C:\Windows\Installer\MSI7A22.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFCCA60E74A004A26C.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_2078311376\manifest.fingerprint opera.exe File created C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping11108_588432205\_metadata\verified_contents.json Snetchball.exe File opened for modification C:\Windows\Installer\MSI8E8C.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_1878141882\crl-set opera.exe File opened for modification C:\Windows\Installer\MSI8197.tmp msiexec.exe File opened for modification C:\Windows\Installer\e64779c.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB477.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log MsiExec.exe File created C:\Windows\Installer\e64779c.msi msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_2078311376\kp_pinslist.pb opera.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_2132715359\manifest.json opera.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 8532 sc.exe 11496 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
pid pid_target Process procid_target 1536 4616 WerFault.exe 111 1800 4616 WerFault.exe 111 4928 4616 WerFault.exe 111 1832 4616 WerFault.exe 111 2136 4616 WerFault.exe 111 3432 4616 WerFault.exe 111 3164 4616 WerFault.exe 111 5380 4616 WerFault.exe 111 1836 4616 WerFault.exe 111 1712 4616 WerFault.exe 111 5436 4616 WerFault.exe 111 1552 4616 WerFault.exe 111 3740 4616 WerFault.exe 111 1380 4616 WerFault.exe 111 2452 4616 WerFault.exe 111 3096 4616 WerFault.exe 111 5488 4616 WerFault.exe 111 3176 4616 WerFault.exe 111 3916 4616 WerFault.exe 111 4856 4616 WerFault.exe 111 1172 4616 WerFault.exe 111 1200 4616 WerFault.exe 111 5136 4616 WerFault.exe 111 3544 4616 WerFault.exe 111 4896 4616 WerFault.exe 111 3820 4616 WerFault.exe 111 2984 4616 WerFault.exe 111 1976 4616 WerFault.exe 111 1552 4616 WerFault.exe 111 5184 4616 WerFault.exe 111 4456 4616 WerFault.exe 111 5708 4616 WerFault.exe 111 1884 4616 WerFault.exe 111 4684 4616 WerFault.exe 111 2136 4616 WerFault.exe 111 5676 4616 WerFault.exe 111 4652 4616 WerFault.exe 111 3156 4616 WerFault.exe 111 1668 4616 WerFault.exe 111 2804 4616 WerFault.exe 111 1100 4616 WerFault.exe 111 2348 4616 WerFault.exe 111 800 4616 WerFault.exe 111 2632 4616 WerFault.exe 111 4348 4616 WerFault.exe 111 5184 4616 WerFault.exe 111 1828 4616 WerFault.exe 111 1980 4616 WerFault.exe 111 1960 4616 WerFault.exe 111 5664 4616 WerFault.exe 111 6100 4616 WerFault.exe 111 1832 4616 WerFault.exe 111 1012 4616 WerFault.exe 111 4704 4616 WerFault.exe 111 1908 4616 WerFault.exe 111 1712 4616 WerFault.exe 111 3944 5300 WerFault.exe 262 2888 4616 WerFault.exe 111 5260 4616 WerFault.exe 111 5884 4616 WerFault.exe 111 4456 4936 WerFault.exe 236 3020 1180 WerFault.exe 335 5972 4616 WerFault.exe 111 2760 4616 WerFault.exe 111 -
NSIS installer 2 IoCs
resource yara_rule behavioral3/files/0x000300000002ab92-739.dat nsis_installer_1 behavioral3/files/0x000300000002ab92-739.dat nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags Snetchball.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 Snetchball.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 Snetchball.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags Snetchball.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags Snetchball.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 Snetchball.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags Snetchball.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags Snetchball.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 Snetchball.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags Snetchball.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 Snetchball.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 Snetchball.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags Snetchball.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 Snetchball.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 opera.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz opera.exe -
Enumerates system info in registry 2 TTPs 15 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName opera.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName opera.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName NNRaWlSuztxFkBux.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS opera.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS NNRaWlSuztxFkBux.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS opera.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer opera.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe -
Modifies Control Panel 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Key created \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Colors Hide.me.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\\\Cursors\\\\aero_arrow.cur" Snetchball.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\browser_assistant.exe = "9000" assistant_installer.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer NNRaWlSuztxFkBux.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix xJvChqb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket xJvChqb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer xJvChqb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" xJvChqb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\.opdownload\OpenWithProgIDs\OperaStable = "0" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\927810E09CE79354AB72F710E0D3F4CD\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CDDD46F1E6D3CF040A2BCFF56D94CA9D\MainFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\927810E09CE79354AB72F710E0D3F4CD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\927810E09CE79354AB72F710E0D3F4CD\PackageCode = "E250100FF7942264B9B881BEB21B60C0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDDD46F1E6D3CF040A2BCFF56D94CA9D\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B8D818070770F834FA7DF76D06E59FB7\AdvertiseFlags = "388" msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 opera.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{185963d2-4c1e-4ef1-a6a4-5219e12fb512} windowsdesktop-runtime-6.0.26-win-x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{185963d2-4c1e-4ef1-a6a4-5219e12fb512}\Version = "6.0.26.33205" windowsdesktop-runtime-6.0.26-win-x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD2D219C9E602D94C9BB69BA49A52CCD\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDDD46F1E6D3CF040A2BCFF56D94CA9D\DeploymentFlags = "3" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" opera.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\927810E09CE79354AB72F710E0D3F4CD\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.104.6996_x86 windowsdesktop-runtime-6.0.26-win-x86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.104.7000_x86\Dependents windowsdesktop-runtime-6.0.26-win-x86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD2D219C9E602D94C9BB69BA49A52CCD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDDD46F1E6D3CF040A2BCFF56D94CA9D\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\OperaStable\URL Protocol installer.exe Key created \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\.opdownload\OpenWithProgIDs installer.exe Key created \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Applications installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" opera.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6B5C96B4D6E8FD47BD1B85CD620D5A9\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\.htm\OpenWithProgids\OperaStable = "0" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\927810E09CE79354AB72F710E0D3F4CD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDDD46F1E6D3CF040A2BCFF56D94CA9D\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDDD46F1E6D3CF040A2BCFF56D94CA9D\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\325FFCB1B86F58E4BA38FF303ACA40A1\SourceList\Net msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} opera.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6B5C96B4D6E8FD47BD1B85CD620D5A9\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86\Dependents windowsdesktop-runtime-6.0.26-win-x86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\325FFCB1B86F58E4BA38FF303ACA40A1\Assignment = "1" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings opera.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6B5C96B4D6E8FD47BD1B85CD620D5A9\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{B69C5B6E-E6D4-4DF8-B71D-8BC56D025D9A}v48.104.7000\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD2D219C9E602D94C9BB69BA49A52CCD\Version = "812129112" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\WOW6432Node\CLSID\{E7629152-0A34-4487-B787-5D1144304455}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\112.0.5197.25\\notification_helper.exe" installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff opera.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDDD46F1E6D3CF040A2BCFF56D94CA9D msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDDD46F1E6D3CF040A2BCFF56D94CA9D\Version = "812129108" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\.xhtml\OpenWithProgIDs installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F875A1B8D6551536AF75FF1D328CBE2B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\325FFCB1B86F58E4BA38FF303ACA40A1\SourceList\PackageName = "ovpn-dco-x64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B8D818070770F834FA7DF76D06E59FB7\SourceList\Media msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\.shtml installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6B5C96B4D6E8FD47BD1B85CD620D5A9\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\325FFCB1B86F58E4BA38FF303ACA40A1\PackageCode = "7FCDAA4E1DB248B45BAEBEC4D8456673" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E08C2D9AD5BCF804B8875859452F4D34 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\927810E09CE79354AB72F710E0D3F4CD\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{0E018729-7EC9-4539-BA27-7F010E3D4FDC}v48.104.7000\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6B5C96B4D6E8FD47BD1B85CD620D5A9\ProductName = "Microsoft .NET Host FX Resolver - 6.0.26 (x86)" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6B5C96B4D6E8FD47BD1B85CD620D5A9\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD2D219C9E602D94C9BB69BA49A52CCD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.104.6996_x86\Version = "48.104.6996" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.104.7000_x86\Version = "48.104.7000" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.104.7000_x86\DisplayName = "Microsoft .NET Host FX Resolver - 6.0.26 (x86)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\325FFCB1B86F58E4BA38FF303ACA40A1\ProductName = "hide.me ovpn-dco" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86\Dependents\{185963d2-4c1e-4ef1-a6a4-5219e12fb512} windowsdesktop-runtime-6.0.26-win-x86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.104.6996_x86\Dependents windowsdesktop-runtime-6.0.26-win-x86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B8D818070770F834FA7DF76D06E59FB7\InstanceType = "0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\WOW6432Node\CLSID\{E7629152-0A34-4487-B787-5D1144304455} installer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1210443139-7911939-2760828654-1000\{B425D91F-6352-4023-9BFB-5BFB24B2B8C4} opera.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.104.7000_x86\ = "{B69C5B6E-E6D4-4DF8-B71D-8BC56D025D9A}" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD2D219C9E602D94C9BB69BA49A52CCD\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD2D219C9E602D94C9BB69BA49A52CCD\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{C912D2DF-06E9-49D2-9CBB-96AB945AC2DC}v48.104.7000\\" msiexec.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e setup.exe -
NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\setup_Ot4AI2mJd6.zip:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Hide.me-Setup-4.1.2.exe:Zone.Identifier opera.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1960 schtasks.exe 5580 schtasks.exe 5308 schtasks.exe 1044 schtasks.exe 3356 schtasks.exe 3560 schtasks.exe 1380 schtasks.exe 3524 schtasks.exe 6056 schtasks.exe 5756 schtasks.exe 3652 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5560 msedge.exe 5560 msedge.exe 4992 msedge.exe 4992 msedge.exe 3436 identity_helper.exe 3436 identity_helper.exe 1960 msedge.exe 1960 msedge.exe 4576 msedge.exe 4576 msedge.exe 5892 setup_Ot4AI2mJd6.tmp 5892 setup_Ot4AI2mJd6.tmp 4616 videomachine32.exe 4616 videomachine32.exe 4616 videomachine32.exe 4616 videomachine32.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 952 powershell.exe 952 powershell.exe 952 powershell.exe 2068 powershell.exe 2068 powershell.exe 2068 powershell.exe 4840 Tupx4FYzVHvOprhfeXU.exe 4840 Tupx4FYzVHvOprhfeXU.exe 4840 Tupx4FYzVHvOprhfeXU.exe 4840 Tupx4FYzVHvOprhfeXU.exe 4840 Tupx4FYzVHvOprhfeXU.exe 4616 videomachine32.exe 4616 videomachine32.exe 4644 powershell.exe 4644 powershell.exe 4644 powershell.exe 5288 powershell.exe 5288 powershell.exe 5288 powershell.exe 1916 powershell.exe 1916 powershell.exe 1916 powershell.exe 4616 videomachine32.exe 4616 videomachine32.exe 5372 powershell.exe 5372 powershell.exe 5372 powershell.exe 4744 powershell.exe 4744 powershell.exe 4744 powershell.exe 4216 powershell.EXE 4216 powershell.EXE 4216 powershell.EXE 4616 videomachine32.exe 4616 videomachine32.exe 1180 xJvChqb.exe 1180 xJvChqb.exe 1180 xJvChqb.exe 1180 xJvChqb.exe 1180 xJvChqb.exe 1180 xJvChqb.exe 1180 xJvChqb.exe 1180 xJvChqb.exe 1180 xJvChqb.exe -
Suspicious behavior: LoadsDriver 30 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 684 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
pid Process 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 952 powershell.exe Token: SeDebugPrivilege 2068 powershell.exe Token: SeDebugPrivilege 4644 powershell.exe Token: SeDebugPrivilege 5288 powershell.exe Token: SeIncreaseQuotaPrivilege 5576 WMIC.exe Token: SeSecurityPrivilege 5576 WMIC.exe Token: SeTakeOwnershipPrivilege 5576 WMIC.exe Token: SeLoadDriverPrivilege 5576 WMIC.exe Token: SeSystemProfilePrivilege 5576 WMIC.exe Token: SeSystemtimePrivilege 5576 WMIC.exe Token: SeProfSingleProcessPrivilege 5576 WMIC.exe Token: SeIncBasePriorityPrivilege 5576 WMIC.exe Token: SeCreatePagefilePrivilege 5576 WMIC.exe Token: SeBackupPrivilege 5576 WMIC.exe Token: SeRestorePrivilege 5576 WMIC.exe Token: SeShutdownPrivilege 5576 WMIC.exe Token: SeDebugPrivilege 5576 WMIC.exe Token: SeSystemEnvironmentPrivilege 5576 WMIC.exe Token: SeRemoteShutdownPrivilege 5576 WMIC.exe Token: SeUndockPrivilege 5576 WMIC.exe Token: SeManageVolumePrivilege 5576 WMIC.exe Token: 33 5576 WMIC.exe Token: 34 5576 WMIC.exe Token: 35 5576 WMIC.exe Token: 36 5576 WMIC.exe Token: SeIncreaseQuotaPrivilege 5576 WMIC.exe Token: SeSecurityPrivilege 5576 WMIC.exe Token: SeTakeOwnershipPrivilege 5576 WMIC.exe Token: SeLoadDriverPrivilege 5576 WMIC.exe Token: SeSystemProfilePrivilege 5576 WMIC.exe Token: SeSystemtimePrivilege 5576 WMIC.exe Token: SeProfSingleProcessPrivilege 5576 WMIC.exe Token: SeIncBasePriorityPrivilege 5576 WMIC.exe Token: SeCreatePagefilePrivilege 5576 WMIC.exe Token: SeBackupPrivilege 5576 WMIC.exe Token: SeRestorePrivilege 5576 WMIC.exe Token: SeShutdownPrivilege 5576 WMIC.exe Token: SeDebugPrivilege 5576 WMIC.exe Token: SeSystemEnvironmentPrivilege 5576 WMIC.exe Token: SeRemoteShutdownPrivilege 5576 WMIC.exe Token: SeUndockPrivilege 5576 WMIC.exe Token: SeManageVolumePrivilege 5576 WMIC.exe Token: 33 5576 WMIC.exe Token: 34 5576 WMIC.exe Token: 35 5576 WMIC.exe Token: 36 5576 WMIC.exe Token: SeDebugPrivilege 1916 powershell.exe Token: SeDebugPrivilege 5372 powershell.exe Token: SeDebugPrivilege 4744 powershell.exe Token: SeDebugPrivilege 4216 powershell.EXE Token: SeDebugPrivilege 4880 powershell.exe Token: SeAssignPrimaryTokenPrivilege 488 WMIC.exe Token: SeIncreaseQuotaPrivilege 488 WMIC.exe Token: SeSecurityPrivilege 488 WMIC.exe Token: SeTakeOwnershipPrivilege 488 WMIC.exe Token: SeLoadDriverPrivilege 488 WMIC.exe Token: SeSystemtimePrivilege 488 WMIC.exe Token: SeBackupPrivilege 488 WMIC.exe Token: SeRestorePrivilege 488 WMIC.exe Token: SeShutdownPrivilege 488 WMIC.exe Token: SeSystemEnvironmentPrivilege 488 WMIC.exe Token: SeUndockPrivilege 488 WMIC.exe Token: SeManageVolumePrivilege 488 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 488 WMIC.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 5892 setup_Ot4AI2mJd6.tmp 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 1004 cINXK8h3siB1IdjEdc.tmp 2920 installer.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe -
Suspicious use of SendNotifyMessage 44 IoCs
pid Process 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 1968 opera.exe 1968 opera.exe 1968 opera.exe 1968 opera.exe 1968 opera.exe 1968 opera.exe 1968 opera.exe 1968 opera.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3192 opera.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4992 wrote to memory of 240 4992 msedge.exe 81 PID 4992 wrote to memory of 240 4992 msedge.exe 81 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 988 4992 msedge.exe 82 PID 4992 wrote to memory of 5560 4992 msedge.exe 83 PID 4992 wrote to memory of 5560 4992 msedge.exe 83 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 PID 4992 wrote to memory of 3880 4992 msedge.exe 84 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sites.google.com/view/wdawdawdqe23123/home1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdc41c3cb8,0x7ffdc41c3cc8,0x7ffdc41c3cd82⤵PID:240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1972 /prefetch:22⤵PID:988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:82⤵PID:3880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:3860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:12⤵PID:3748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:12⤵PID:5240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:12⤵PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:12⤵PID:5664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:12⤵PID:5260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:12⤵PID:2608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:12⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:12⤵PID:2444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:12⤵PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:12⤵PID:2232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:12⤵PID:5884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,4832522598480342682,17801882731912727943,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5288 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1432
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3272
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2032
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4916
-
C:\Users\Admin\Desktop\setup_Ot4AI2mJd6.exe"C:\Users\Admin\Desktop\setup_Ot4AI2mJd6.exe"1⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\is-GPV8F.tmp\setup_Ot4AI2mJd6.tmp"C:\Users\Admin\AppData\Local\Temp\is-GPV8F.tmp\setup_Ot4AI2mJd6.tmp" /SL5="$A01E4,6597852,56832,C:\Users\Admin\Desktop\setup_Ot4AI2mJd6.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:5892 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /F /TN "Video_Machine_7172"3⤵PID:4824
-
-
C:\Users\Admin\AppData\Local\Video Machine\videomachine32.exe"C:\Users\Admin\AppData\Local\Video Machine\videomachine32.exe" 8a3ae7e90cf615125c962d1184937b693⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4616 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 8444⤵
- Program crash
PID:1536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 8524⤵
- Program crash
PID:1800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 9324⤵
- Program crash
PID:4928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 10564⤵
- Program crash
PID:1832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 10404⤵
- Program crash
PID:2136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 10604⤵
- Program crash
PID:3432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 11084⤵
- Program crash
PID:3164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 11404⤵
- Program crash
PID:5380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 11204⤵
- Program crash
PID:1836
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 11044⤵
- Program crash
PID:1712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 8564⤵
- Program crash
PID:5436
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 13484⤵
- Program crash
PID:1552
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 15404⤵
- Program crash
PID:3740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 10964⤵
- Program crash
PID:1380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 16604⤵
- Program crash
PID:2452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 18204⤵
- Program crash
PID:3096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 20244⤵
- Program crash
PID:5488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://linkify.ru/r/johniedoe4⤵PID:2208
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffdc41c3cb8,0x7ffdc41c3cc8,0x7ffdc41c3cd85⤵PID:5044
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 17204⤵
- Program crash
PID:3176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 16724⤵
- Program crash
PID:3916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 17964⤵
- Program crash
PID:4856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 12484⤵
- Program crash
PID:1172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 17164⤵
- Program crash
PID:1200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 18164⤵
- Program crash
PID:5136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 9404⤵
- Program crash
PID:3544
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 18364⤵
- Program crash
PID:4896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 20604⤵
- Program crash
PID:3820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 17164⤵
- Program crash
PID:2984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 9404⤵
- Program crash
PID:1976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 17724⤵
- Program crash
PID:1552
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 17164⤵
- Program crash
PID:5184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 20244⤵
- Program crash
PID:4456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 17724⤵
- Program crash
PID:5708
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 20244⤵
- Program crash
PID:1884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 19524⤵
- Program crash
PID:4684
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\Lv9juGNr\cINXK8h3siB1IdjEdc.exe"4⤵PID:2480
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\Lv9juGNr\cINXK8h3siB1IdjEdc.exe"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\h6WSdLUh\Tupx4FYzVHvOprhfeXU.exe"4⤵PID:2116
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\h6WSdLUh\Tupx4FYzVHvOprhfeXU.exe"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 19404⤵
- Program crash
PID:2136
-
-
C:\Users\Admin\AppData\Local\Temp\Lv9juGNr\cINXK8h3siB1IdjEdc.exeC:\Users\Admin\AppData\Local\Temp\Lv9juGNr\cINXK8h3siB1IdjEdc.exe4⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\is-BB1SH.tmp\cINXK8h3siB1IdjEdc.tmp"C:\Users\Admin\AppData\Local\Temp\is-BB1SH.tmp\cINXK8h3siB1IdjEdc.tmp" /SL5="$20382,4144194,54272,C:\Users\Admin\AppData\Local\Temp\Lv9juGNr\cINXK8h3siB1IdjEdc.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:1004 -
C:\Users\Admin\AppData\Local\Concert Player Free\concertplayerfree32.exe"C:\Users\Admin\AppData\Local\Concert Player Free\concertplayerfree32.exe" -i6⤵
- Executes dropped EXE
PID:2648
-
-
C:\Users\Admin\AppData\Local\Concert Player Free\concertplayerfree32.exe"C:\Users\Admin\AppData\Local\Concert Player Free\concertplayerfree32.exe" -s6⤵
- Executes dropped EXE
PID:5364
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 21564⤵
- Program crash
PID:5676
-
-
C:\Users\Admin\AppData\Local\Temp\h6WSdLUh\Tupx4FYzVHvOprhfeXU.exeC:\Users\Admin\AppData\Local\Temp\h6WSdLUh\Tupx4FYzVHvOprhfeXU.exe /sid=3 /pid=10904⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"5⤵
- Adds Run key to start application
PID:3140 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exeC:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe6⤵
- Checks SCSI registry key(s)
PID:3176 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.153 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2888 --field-trial-handle=2892,i,17553514421107839891,5920141305429073207,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:27⤵PID:6348
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.153 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3004 --field-trial-handle=2892,i,17553514421107839891,5920141305429073207,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:87⤵PID:5572
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.153 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3432 --field-trial-handle=2892,i,17553514421107839891,5920141305429073207,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:87⤵PID:5404
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.153 Mobile/15E148 Safari/604.1" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=2892,i,17553514421107839891,5920141305429073207,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:17⤵PID:4992
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"8⤵PID:7864
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"8⤵
- Modifies Control Panel
PID:7956 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵PID:8268
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:8748 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵
- Modifies Control Panel
PID:10008
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵
- Modifies Control Panel
PID:9508
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:10636
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵
- Modifies Control Panel
PID:11244
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:4884
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:11312
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:13100
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:8840
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵
- Modifies Control Panel
PID:10176
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:10408
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:10956
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:11620
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:1608
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:8848
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:13112
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:9020
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:10312
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵
- Modifies Control Panel
PID:11056
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:11768
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:13212
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:12112
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:7580 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:11736
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:5456
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:7504 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:13264
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:12248
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:8476 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:12812
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:2988
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:9544
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:9896
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:9480
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:10732
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:472
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:11876
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:6368
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:9848
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵PID:8304
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:8896 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:10548
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵
- Modifies Control Panel
PID:11228
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:12084
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:9088
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:11884
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:13296
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:12984
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:3636 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:1472
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:9796
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:4596 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:5556
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:7172
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:9404
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:9888
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:9340
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:10544
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:11192
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:11848
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:5592
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:10488
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:2016
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵PID:8340
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:8888 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:11204
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:11928
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:9116 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:6704
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:9816
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:7272
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:8200
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:13156
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:6868
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:5060
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:8568
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:8984
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:9672
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:10020
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:10212
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:10916
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:11564
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:11348
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:10880
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:9164
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵
- Modifies Control Panel
PID:8380 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:9076
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵
- Modifies Control Panel
PID:11748
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:12524
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:7972
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:12456
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:9868
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:13088
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:7864 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:12804
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:9096
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:13120
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:8632
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:7520
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:5164
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:9716
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:10164
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:10604
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:11496
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:12532
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵PID:8432
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:7876
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:2532 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.153 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3036 --field-trial-handle=3040,i,5039556473107385943,14927791528944395144,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:212⤵PID:9112
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.153 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3564 --field-trial-handle=3040,i,5039556473107385943,14927791528944395144,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:812⤵PID:9912
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.153 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3572 --field-trial-handle=3040,i,5039556473107385943,14927791528944395144,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:812⤵PID:9652
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.153 Mobile/15E148 Safari/604.1" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3628 --field-trial-handle=3040,i,5039556473107385943,14927791528944395144,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:112⤵PID:9596
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"13⤵PID:13064
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"14⤵
- Drops file in Windows directory
- Modifies Control Panel
PID:7896 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2852 --field-trial-handle=2856,i,10397299931545758216,14830422217016723724,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:215⤵PID:9552
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3156 --field-trial-handle=2856,i,10397299931545758216,14830422217016723724,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:815⤵PID:8172
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3676 --field-trial-handle=2856,i,10397299931545758216,14830422217016723724,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:815⤵PID:9432
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3684 --field-trial-handle=2856,i,10397299931545758216,14830422217016723724,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:115⤵PID:11288
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3716 --field-trial-handle=2856,i,10397299931545758216,14830422217016723724,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:115⤵PID:4436
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"16⤵PID:11936
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"17⤵
- Checks SCSI registry key(s)
PID:4296 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Android 10; Mobile; rv:128.0) Gecko/128.0 Firefox/128.0" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2792 --field-trial-handle=2796,i,16300666974482491158,17880089502462468648,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:218⤵PID:11076
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Android 10; Mobile; rv:128.0) Gecko/128.0 Firefox/128.0" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3064 --field-trial-handle=2796,i,16300666974482491158,17880089502462468648,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:818⤵PID:8672
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Android 10; Mobile; rv:128.0) Gecko/128.0 Firefox/128.0" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3288 --field-trial-handle=2796,i,16300666974482491158,17880089502462468648,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:818⤵PID:12144
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Android 10; Mobile; rv:128.0) Gecko/128.0 Firefox/128.0" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3384 --field-trial-handle=2796,i,16300666974482491158,17880089502462468648,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:118⤵PID:8956
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"19⤵PID:9660
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"20⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:11108 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2968 --field-trial-handle=2972,i,16925144257803216927,13763131857989162654,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:221⤵PID:2300
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2044 --field-trial-handle=2972,i,16925144257803216927,13763131857989162654,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:821⤵PID:8036
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3376 --field-trial-handle=2972,i,16925144257803216927,13763131857989162654,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:821⤵PID:8896
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3528 --field-trial-handle=2972,i,16925144257803216927,13763131857989162654,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:121⤵PID:9340
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3540 --field-trial-handle=2972,i,16925144257803216927,13763131857989162654,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:121⤵PID:11192
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=4968 --field-trial-handle=2972,i,16925144257803216927,13763131857989162654,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:821⤵PID:6888
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=4360 --field-trial-handle=2972,i,16925144257803216927,13763131857989162654,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:221⤵PID:12728
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"20⤵PID:7600
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"20⤵PID:7672
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"20⤵PID:10340
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"20⤵PID:488
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"20⤵PID:11096
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"19⤵PID:8648
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"19⤵PID:8632
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"19⤵PID:9976
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"19⤵PID:13064
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"19⤵PID:4032
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Android 10; Mobile; rv:128.0) Gecko/128.0 Firefox/128.0" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3700 --field-trial-handle=2796,i,16300666974482491158,17880089502462468648,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:118⤵PID:8436
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Android 10; Mobile; rv:128.0) Gecko/128.0 Firefox/128.0" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4584 --field-trial-handle=2796,i,16300666974482491158,17880089502462468648,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:118⤵PID:11044
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"17⤵PID:12436
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"17⤵PID:10872
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"17⤵PID:8968
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"17⤵PID:7868
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"17⤵PID:9276
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"16⤵PID:7908
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"16⤵PID:7996
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"16⤵PID:10144
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"16⤵PID:12148
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"16⤵PID:10084
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4292 --field-trial-handle=2856,i,10397299931545758216,14830422217016723724,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:115⤵PID:13276
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"14⤵PID:6588
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"14⤵PID:9976
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"14⤵PID:8560
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"14⤵PID:5360
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"14⤵PID:9472
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"13⤵PID:11756
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"13⤵PID:12448
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"13⤵PID:9644
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"13⤵PID:11368
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"13⤵PID:12232
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"13⤵PID:12716
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.153 Mobile/15E148 Safari/604.1" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3640 --field-trial-handle=3040,i,5039556473107385943,14927791528944395144,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:112⤵PID:9400
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.153 Mobile/15E148 Safari/604.1" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4232 --field-trial-handle=3040,i,5039556473107385943,14927791528944395144,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:112⤵PID:10800
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:10928
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:8640
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:7760
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:12620
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:9524
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:7224
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:9268
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:9772
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:10156
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:10204
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:10828
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:11256
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:11908
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:13252
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:12032
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵
- Modifies Control Panel
PID:8520 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:664 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"11⤵PID:13040
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:9396
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:9820
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:10040
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:10724
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:11520
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:1196
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:12608
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵PID:8612
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵
- Modifies Control Panel
PID:8660 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:10072
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:10536
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:11220
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:11900
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:13148
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:7584
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:11860
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵
- Modifies Control Panel
PID:8808 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:9468
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:10588
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:11288
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:12076
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:12628
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:9312
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵
- Modifies Control Panel
PID:8928 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:10612
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:11236
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:11892
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵
- Modifies Control Panel
PID:9144 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:11916
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:13168
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:11588
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:11868
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵PID:7808
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:11276
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:11304
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵
- Modifies Control Panel
PID:6208 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Modifies Control Panel
PID:12240
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵
- Modifies Control Panel
PID:7292 -
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵PID:10316
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵
- Modifies Control Panel
PID:9256
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵PID:9764
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵
- Modifies Control Panel
PID:10144
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵
- Modifies Control Panel
PID:10300
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵PID:10648
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵
- Modifies Control Panel
PID:11212
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵PID:6976
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵PID:9656
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"9⤵PID:8968
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"8⤵PID:7760
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"8⤵PID:8164
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"8⤵PID:7496
-
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.153 Mobile/15E148 Safari/604.1" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3628 --field-trial-handle=2892,i,17553514421107839891,5920141305429073207,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:17⤵PID:5060
-
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.153 Mobile/15E148 Safari/604.1" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4100 --field-trial-handle=2892,i,17553514421107839891,5920141305429073207,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:17⤵PID:7304
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 21204⤵
- Program crash
PID:4652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 21564⤵
- Program crash
PID:3156
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 18364⤵
- Program crash
PID:1668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 21804⤵
- Program crash
PID:2804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 8324⤵
- Program crash
PID:1100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 21804⤵
- Program crash
PID:2348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 21524⤵
- Program crash
PID:800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 19404⤵
- Program crash
PID:2632
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 20564⤵
- Program crash
PID:4348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 18764⤵
- Program crash
PID:5184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 18204⤵
- Program crash
PID:1828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 21844⤵
- Program crash
PID:1980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 19044⤵
- Program crash
PID:1960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 20964⤵
- Program crash
PID:5664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 18004⤵
- Program crash
PID:6100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 16684⤵
- Program crash
PID:1832
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\TlwWJwwZ\NNRaWlSuztxFkBux.exe"4⤵PID:5412
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\TlwWJwwZ\NNRaWlSuztxFkBux.exe"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4644
-
-
-
C:\Users\Admin\AppData\Local\Temp\TlwWJwwZ\NNRaWlSuztxFkBux.exeC:\Users\Admin\AppData\Local\Temp\TlwWJwwZ\NNRaWlSuztxFkBux.exe /did=757674 /S4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
PID:4936 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"5⤵PID:4272
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True6⤵PID:1588
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5288 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵
- Suspicious use of AdjustPrivilegeToken
PID:5576
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bAFePNRVjvDkkTEmWE" /SC once /ST 13:43:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\TlwWJwwZ\NNRaWlSuztxFkBux.exe\" Cq /cSdidzY 757674 /S" /V1 /F5⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:1960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 6365⤵
- Program crash
PID:4456
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 21244⤵
- Program crash
PID:1012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 21444⤵
- Program crash
PID:4704
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\NOjFC4fh\POmK4zzYzf99JwX8Sbfm.exe"4⤵PID:196
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\NOjFC4fh\POmK4zzYzf99JwX8Sbfm.exe"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1916
-
-
-
C:\Users\Admin\AppData\Local\Temp\NOjFC4fh\POmK4zzYzf99JwX8Sbfm.exeC:\Users\Admin\AppData\Local\Temp\NOjFC4fh\POmK4zzYzf99JwX8Sbfm.exe --silent --allusers=04⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\7zS8655DA1A\setup.exeC:\Users\Admin\AppData\Local\Temp\7zS8655DA1A\setup.exe --silent --allusers=0 --server-tracking-blob=YzY1ODg4ZDE4NWQxNmQ2YjYwNzM5ZDU5MzA2NjlhMzdiYzMzM2JmMDQyM2Y2Nzk5MmVkZjhlNmVmNThiOTI3YTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1SU1RQJnV0bV9jYW1wYWlnbj1vcDEzMiIsInRpbWVzdGFtcCI6IjE3MjEyMjM3MTkuMTI5OSIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTguMC4wLjAgU2FmYXJpLzUzNy4zNiIsInV0bSI6eyJjYW1wYWlnbiI6Im9wMTMyIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiUlNUUCJ9LCJ1dWlkIjoiMjMyYzE0MWQtZGQwMC00YzRjLWIwNWQtMzlmNGE0MjZlNmM2In0=5⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\7zS8655DA1A\setup.exeC:\Users\Admin\AppData\Local\Temp\7zS8655DA1A\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.25 --initial-client-data=0x32c,0x330,0x334,0x308,0x338,0x71ffa174,0x71ffa180,0x71ffa18c6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3384
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --version6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8655DA1A\setup.exe"C:\Users\Admin\AppData\Local\Temp\7zS8655DA1A\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1684 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240717134243" --session-guid=e97b3b3f-2df9-4363-9918-487e87ea20ac --server-tracking-blob=MGY2YWM1NjI3Mjk3MThhOGRkZjRhMjUzNzkwZTI1MjJjZWM5OTNhNzZkYTYzNTRhNTEzYTE4M2ZhZDYwZGEzNTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1SU1RQJnV0bV9jYW1wYWlnbj1vcDEzMiIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcyMTIyMzcxOS4xMjk5IiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExOC4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidXRtIjp7ImNhbXBhaWduIjoib3AxMzIiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJSU1RQIn0sInV1aWQiOiIyMzJjMTQxZC1kZDAwLTRjNGMtYjA1ZC0zOWY0YTQyNmU2YzYifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=F4050000000000006⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\7zS8655DA1A\setup.exeC:\Users\Admin\AppData\Local\Temp\7zS8655DA1A\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.25 --initial-client-data=0x338,0x33c,0x340,0x308,0x344,0x7138a174,0x7138a180,0x7138a18c7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5436
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\installer.exe"C:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\installer.exe" --backend --initial-pid=1684 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407171342431" --session-guid=e97b3b3f-2df9-4363-9918-487e87ea20ac --server-tracking-blob=MGY2YWM1NjI3Mjk3MThhOGRkZjRhMjUzNzkwZTI1MjJjZWM5OTNhNzZkYTYzNTRhNTEzYTE4M2ZhZDYwZGEzNTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1SU1RQJnV0bV9jYW1wYWlnbj1vcDEzMiIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcyMTIyMzcxOS4xMjk5IiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExOC4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidXRtIjp7ImNhbXBhaWduIjoib3AxMzIiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJSU1RQIn0sInV1aWQiOiIyMzJjMTQxZC1kZDAwLTRjNGMtYjA1ZC0zOWY0YTQyNmU2YzYifQ== --silent --desktopshortcut=1 --install-subfolder=112.0.5197.257⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2920 -
C:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\installer.exeC:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.25 --initial-client-data=0x2ac,0x2b0,0x2b4,0x280,0x2b8,0x7ffdb25a4a60,0x7ffdb25a4a6c,0x7ffdb25a4a788⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4820
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407171342431\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407171342431\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=08⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies Internet Explorer settings
PID:5348 -
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407171342431\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407171342431\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=111.0.5168.25 --initial-client-data=0x258,0x25c,0x260,0x234,0x264,0x759f88,0x759f94,0x759fa09⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4148
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --ran-launcher --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407171342431\be76331b95dfc399cd776d2fc68021e0db03cc4f.crx"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks system information in the registry
- Drops file in Windows directory
- Enumerates system info in registry
PID:1792 -
C:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.25 --initial-client-data=0x88,0x8c,0x90,0x84,0x2c8,0x7ffd921f4488,0x7ffd921f4498,0x7ffd921f44a89⤵
- Executes dropped EXE
PID:780
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1824,i,1025219466015120711,3803384749523408297,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=2104,i,1025219466015120711,3803384749523408297,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:119⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=2328,i,1025219466015120711,3803384749523408297,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:139⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4684
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --show-intro-overlay --start-maximized8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6136 -
C:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.25 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d0,0x7ffd921f4488,0x7ffd921f4498,0x7ffd921f44a89⤵
- Executes dropped EXE
PID:3860
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407171342431\assistant\Assistant_111.0.5168.25_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407171342431\assistant\Assistant_111.0.5168.25_Setup.exe_sfx.exe"6⤵
- Executes dropped EXE
PID:4388
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407171342431\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407171342431\assistant\assistant_installer.exe" --version6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407171342431\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407171342431\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=111.0.5168.25 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x759f88,0x759f94,0x759fa07⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4264
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 20964⤵
- Program crash
PID:1908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 21804⤵
- Program crash
PID:1712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 13684⤵
- Program crash
PID:2888
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 17764⤵
- Program crash
PID:5260
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 19164⤵
- Program crash
PID:5884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 17844⤵
- Program crash
PID:5972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 14644⤵
- Program crash
PID:2760
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 17964⤵PID:7108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 1524⤵PID:6796
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4616 -ip 46161⤵PID:3000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4616 -ip 46161⤵PID:4200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4616 -ip 46161⤵PID:5760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4616 -ip 46161⤵PID:2948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4616 -ip 46161⤵PID:4984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4616 -ip 46161⤵PID:5376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4616 -ip 46161⤵PID:4896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4616 -ip 46161⤵PID:3820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4616 -ip 46161⤵PID:4484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4616 -ip 46161⤵PID:1064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4616 -ip 46161⤵PID:4576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4616 -ip 46161⤵PID:2828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4616 -ip 46161⤵PID:5024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4616 -ip 46161⤵PID:4388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4616 -ip 46161⤵PID:5740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4616 -ip 46161⤵PID:4300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4616 -ip 46161⤵PID:448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4616 -ip 46161⤵PID:1180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4616 -ip 46161⤵PID:836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4616 -ip 46161⤵PID:1916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4616 -ip 46161⤵PID:4308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4616 -ip 46161⤵PID:3000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4616 -ip 46161⤵PID:2348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4616 -ip 46161⤵PID:3652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4616 -ip 46161⤵PID:756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4616 -ip 46161⤵PID:2444
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4616 -ip 46161⤵PID:4020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4616 -ip 46161⤵PID:4736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4616 -ip 46161⤵PID:1444
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4616 -ip 46161⤵PID:5964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4616 -ip 46161⤵PID:4912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4616 -ip 46161⤵PID:5232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4616 -ip 46161⤵PID:1096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4616 -ip 46161⤵PID:3304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4616 -ip 46161⤵PID:2112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4616 -ip 46161⤵PID:3556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4616 -ip 46161⤵PID:2884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4616 -ip 46161⤵PID:5996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 4616 -ip 46161⤵PID:5372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4616 -ip 46161⤵PID:4216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4616 -ip 46161⤵PID:3900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4616 -ip 46161⤵PID:5516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4616 -ip 46161⤵PID:4836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4616 -ip 46161⤵PID:4160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4616 -ip 46161⤵PID:664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4616 -ip 46161⤵PID:3948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4616 -ip 46161⤵PID:2648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4616 -ip 46161⤵PID:5576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4616 -ip 46161⤵PID:2760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 4616 -ip 46161⤵PID:2864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4616 -ip 46161⤵PID:1952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 4616 -ip 46161⤵PID:3272
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4616 -ip 46161⤵PID:3844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4616 -ip 46161⤵PID:3692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4616 -ip 46161⤵PID:5276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4616 -ip 46161⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\TlwWJwwZ\NNRaWlSuztxFkBux.exeC:\Users\Admin\AppData\Local\Temp\TlwWJwwZ\NNRaWlSuztxFkBux.exe Cq /cSdidzY 757674 /S1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5300 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5372 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵PID:1044
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:4892
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵PID:5380
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵PID:4264
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵PID:3192
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵PID:2348
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵PID:856
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵PID:1100
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵PID:4996
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵PID:2812
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵PID:1644
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵PID:3844
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵PID:5844
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵PID:5284
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵PID:6056
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵PID:3712
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵PID:3368
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵PID:4804
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵PID:5124
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵PID:5740
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵PID:5184
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵PID:1336
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵PID:4024
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵PID:1236
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵PID:1828
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵PID:1096
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵PID:2452
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵PID:3592
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵PID:3096
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HzsFjTXWNeQmC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HzsFjTXWNeQmC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OuKpxndYOxqU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OuKpxndYOxqU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cDgxmhTtWVUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cDgxmhTtWVUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cZwNMelTBWvimZyZIgR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cZwNMelTBWvimZyZIgR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rQOnGHSVU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rQOnGHSVU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\HnPqWhoqmGMTBRVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\HnPqWhoqmGMTBRVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\niiWlQeXOOWgbGQpI\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\niiWlQeXOOWgbGQpI\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\PQAHLqZWtEGbXhHh\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\PQAHLqZWtEGbXhHh\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4744 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HzsFjTXWNeQmC" /t REG_DWORD /d 0 /reg:323⤵PID:4668
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HzsFjTXWNeQmC" /t REG_DWORD /d 0 /reg:324⤵PID:4272
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HzsFjTXWNeQmC" /t REG_DWORD /d 0 /reg:643⤵PID:892
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OuKpxndYOxqU2" /t REG_DWORD /d 0 /reg:323⤵PID:2052
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OuKpxndYOxqU2" /t REG_DWORD /d 0 /reg:643⤵PID:1624
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cDgxmhTtWVUn" /t REG_DWORD /d 0 /reg:323⤵PID:2732
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cDgxmhTtWVUn" /t REG_DWORD /d 0 /reg:643⤵PID:648
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cZwNMelTBWvimZyZIgR" /t REG_DWORD /d 0 /reg:323⤵PID:3876
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cZwNMelTBWvimZyZIgR" /t REG_DWORD /d 0 /reg:643⤵PID:1056
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rQOnGHSVU" /t REG_DWORD /d 0 /reg:323⤵PID:1972
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rQOnGHSVU" /t REG_DWORD /d 0 /reg:643⤵PID:468
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\HnPqWhoqmGMTBRVB /t REG_DWORD /d 0 /reg:323⤵PID:5308
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\HnPqWhoqmGMTBRVB /t REG_DWORD /d 0 /reg:643⤵PID:4020
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:1172
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:1880
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:2500
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:4500
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\niiWlQeXOOWgbGQpI /t REG_DWORD /d 0 /reg:323⤵PID:2112
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\niiWlQeXOOWgbGQpI /t REG_DWORD /d 0 /reg:643⤵PID:5564
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\PQAHLqZWtEGbXhHh /t REG_DWORD /d 0 /reg:323⤵PID:4104
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\PQAHLqZWtEGbXhHh /t REG_DWORD /d 0 /reg:643⤵PID:832
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gBcEhPufp" /SC once /ST 08:19:00 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Scheduled Task/Job: Scheduled Task
PID:1380
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gBcEhPufp"2⤵PID:3944
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gBcEhPufp"2⤵PID:5932
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "QSIFNGJKzIceSqfWs" /SC once /ST 02:22:09 /RU "SYSTEM" /TR "\"C:\Windows\Temp\PQAHLqZWtEGbXhHh\wZSBseCrdeXsHaE\xJvChqb.exe\" VK /wGRpdidJm 757674 /S" /V1 /F2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:5580
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "QSIFNGJKzIceSqfWs"2⤵PID:1668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5300 -s 7882⤵
- Program crash
PID:3944
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4216 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:5828
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:4740
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:1088
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2396
-
C:\Windows\Temp\PQAHLqZWtEGbXhHh\wZSBseCrdeXsHaE\xJvChqb.exeC:\Windows\Temp\PQAHLqZWtEGbXhHh\wZSBseCrdeXsHaE\xJvChqb.exe VK /wGRpdidJm 757674 /S1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1180 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bAFePNRVjvDkkTEmWE"2⤵PID:6108
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &2⤵PID:1472
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"3⤵PID:5284
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True4⤵PID:6056
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True5⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4880 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True6⤵
- Suspicious use of AdjustPrivilegeToken
PID:488
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\rQOnGHSVU\YiVvmy.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ibTZBvfsMIkqDvb" /V1 /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:3524
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ibTZBvfsMIkqDvb2" /F /xml "C:\Program Files (x86)\rQOnGHSVU\xUgRohK.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
PID:5308
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "ibTZBvfsMIkqDvb"2⤵PID:5836
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "ibTZBvfsMIkqDvb"2⤵PID:4684
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "xSHZUCAqjilgZx" /F /xml "C:\Program Files (x86)\OuKpxndYOxqU2\WQtsCzQ.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
PID:6056
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "kJcXeMqYVTVju2" /F /xml "C:\ProgramData\HnPqWhoqmGMTBRVB\vfSGtqM.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
PID:1044
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ySYiIWAcAnVppWNJZ2" /F /xml "C:\Program Files (x86)\cZwNMelTBWvimZyZIgR\ABEoemD.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
PID:5756
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "YoCeFzzcQXzMAceQvje2" /F /xml "C:\Program Files (x86)\HzsFjTXWNeQmC\lpEIhLf.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
PID:3356
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "nylLUrzGvlCqXtkcc" /SC once /ST 04:21:06 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\PQAHLqZWtEGbXhHh\nFLsxySz\RgGXRLd.dll\",#1 /KGdidCp 757674" /V1 /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:3560
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "nylLUrzGvlCqXtkcc"2⤵PID:2184
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "yShlN1" /SC once /ST 01:48:37 /F /RU "Admin" /TR "\"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe\" --restore-last-session"2⤵
- Scheduled Task/Job: Scheduled Task
PID:3652
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "yShlN1"2⤵PID:1844
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "yShlN1"2⤵PID:5160
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "QSIFNGJKzIceSqfWs"2⤵PID:1552
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 21602⤵
- Program crash
PID:3020
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5300 -ip 53001⤵PID:3820
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\PQAHLqZWtEGbXhHh\nFLsxySz\RgGXRLd.dll",#1 /KGdidCp 7576741⤵PID:5968
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\PQAHLqZWtEGbXhHh\nFLsxySz\RgGXRLd.dll",#1 /KGdidCp 7576742⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Enumerates system info in registry
PID:3188 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "nylLUrzGvlCqXtkcc"3⤵PID:5312
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --restore-last-session1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4392 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdc4183cb8,0x7ffdc4183cc8,0x7ffdc4183cd82⤵PID:1980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1876 /prefetch:22⤵PID:2112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:32⤵PID:1908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:12⤵PID:2188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2904 /prefetch:12⤵PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵PID:3732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:12⤵PID:3848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵PID:5916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:82⤵PID:836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:82⤵PID:6696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:12⤵PID:6992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:12⤵PID:2876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:2884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:12⤵PID:5608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:12⤵PID:6728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:12⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:12⤵PID:6460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1148 /prefetch:22⤵PID:1884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:12⤵PID:8164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:12⤵PID:10580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:82⤵PID:12796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:12⤵PID:1696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:12⤵PID:7888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:12⤵PID:4100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:12⤵PID:9312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:12⤵PID:11188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7124 /prefetch:12⤵PID:10592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:12⤵PID:10992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7184 /prefetch:12⤵PID:5204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7212 /prefetch:12⤵PID:2732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:12⤵PID:10996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7708 /prefetch:12⤵PID:10036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7696 /prefetch:12⤵PID:11280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7592 /prefetch:12⤵PID:7656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2176 /prefetch:12⤵PID:10428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7464 /prefetch:12⤵PID:9132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7636 /prefetch:12⤵PID:11376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7680 /prefetch:12⤵PID:7308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7608 /prefetch:12⤵PID:10712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8392 /prefetch:12⤵PID:9820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9208 /prefetch:12⤵PID:12092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9244 /prefetch:12⤵PID:13172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9260 /prefetch:12⤵PID:10076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9224 /prefetch:12⤵PID:9464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10096 /prefetch:12⤵PID:12224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9700 /prefetch:12⤵PID:13152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9312 /prefetch:12⤵PID:7728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:12⤵PID:3348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:12⤵PID:9532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:12⤵PID:7260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7252 /prefetch:12⤵PID:11112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7488 /prefetch:12⤵PID:9280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8160 /prefetch:12⤵PID:7792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8128 /prefetch:12⤵PID:9244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7312 /prefetch:12⤵PID:7808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8576 /prefetch:12⤵PID:5776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8416 /prefetch:12⤵PID:8320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8072 /prefetch:12⤵PID:5388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8660 /prefetch:12⤵PID:10468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7572 /prefetch:12⤵PID:10156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9804 /prefetch:12⤵PID:12800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10220 /prefetch:12⤵PID:8460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9540 /prefetch:12⤵PID:1364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:12⤵PID:7340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,782225943641306123,1206232711813981383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9680 /prefetch:12⤵PID:7636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4616 -ip 46161⤵PID:436
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=01⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exeC:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=111.0.5168.25 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x5e9f88,0x5e9f94,0x5e9fa02⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6000
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4940 -
C:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.25 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x2cc,0x7ffd921f4488,0x7ffd921f4498,0x7ffd921f44a84⤵
- Executes dropped EXE
PID:4588
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4616 -ip 46161⤵PID:4344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4616 -ip 46161⤵PID:4916
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3500
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4936 -ip 49361⤵PID:1316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1180 -ip 11801⤵PID:5572
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --show-intro-overlay --start-maximized --lowered-browser1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks system information in the registry
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SendNotifyMessage
PID:1968 -
C:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.25 --initial-client-data=0x2b8,0x2bc,0x2c0,0x2b4,0x2c4,0x7ffd921f4488,0x7ffd921f4498,0x7ffd921f44a82⤵
- Executes dropped EXE
PID:8
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2004,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5524
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=1844,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:112⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=2348,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:132⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3564
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=3176,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:142⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3492
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=3180,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:142⤵
- Executes dropped EXE
PID:4484
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=3192,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:142⤵
- Executes dropped EXE
PID:2876
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=3200,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:142⤵
- Executes dropped EXE
PID:3556
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=3208,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:142⤵
- Executes dropped EXE
PID:5124
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3820,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:12⤵
- Executes dropped EXE
PID:5072
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\opera_gx_splash.exe"C:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\opera_gx_splash.exe" --instance-name=dbff851fa759ccb33e726f883720ae502⤵
- Executes dropped EXE
PID:1836
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4188,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:12⤵
- Executes dropped EXE
PID:980
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4392,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:92⤵
- Executes dropped EXE
PID:5556
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4476,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:12⤵
- Executes dropped EXE
PID:1592
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4788,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:12⤵
- Executes dropped EXE
PID:5752
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4832,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:12⤵
- Executes dropped EXE
PID:1284
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=5188,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:92⤵
- Executes dropped EXE
PID:1440
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=5548,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:122⤵
- Executes dropped EXE
PID:5644
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=5872,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:142⤵
- Executes dropped EXE
- Modifies registry class
PID:4644
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5840,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:92⤵
- Executes dropped EXE
PID:6552
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=4292,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:12⤵
- Executes dropped EXE
PID:6568
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=5724,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:142⤵
- Executes dropped EXE
PID:6152
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=6040,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:142⤵
- Executes dropped EXE
PID:6164
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=5820,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:142⤵
- Executes dropped EXE
PID:6176
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\installer.exe"C:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\installer.exe" --fix-taskbar-pins2⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\installer.exeC:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.25 --initial-client-data=0x280,0x284,0x288,0x27c,0x28c,0x7ffda9884a60,0x7ffda9884a6c,0x7ffda9884a783⤵PID:6172
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=6888,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:142⤵
- Executes dropped EXE
PID:3956
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=5764,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:142⤵
- Executes dropped EXE
PID:2072
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=5076,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:142⤵
- Executes dropped EXE
PID:2720
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=7180,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:142⤵PID:2760
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=7184,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:142⤵PID:5416
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=7612,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:142⤵PID:4584
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe"C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --enableipv6 --bypasslauncher --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" --pipeid=oauc_pipe2906202b27b41e4bd66c9238c4b575c12⤵PID:5308
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.25 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff77ed7765c,0x7ff77ed77668,0x7ff77ed776783⤵PID:3136
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=5832,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:142⤵PID:6276
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=7780,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:142⤵PID:7076
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=7920,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:142⤵PID:6740
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=8040,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=8196 /prefetch:142⤵PID:6816
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=5556,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=8332 /prefetch:142⤵PID:6872
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=8488,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=8500 /prefetch:142⤵PID:6916
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=8472,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=8636 /prefetch:92⤵PID:6944
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=8644,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=8792 /prefetch:142⤵PID:6964
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=8036,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=8940 /prefetch:142⤵PID:1032
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=9084,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9092 /prefetch:142⤵PID:2884
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=9080,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=8776 /prefetch:12⤵PID:4216
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=7644,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=7624 /prefetch:142⤵PID:3688
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=7740,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:142⤵PID:5684
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=3544,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=10312 /prefetch:142⤵PID:2828
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=10040,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=10056 /prefetch:142⤵PID:2352
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=10196,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=10100 /prefetch:142⤵PID:4968
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=10000,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9980 /prefetch:142⤵PID:5988
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=9732,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=10172 /prefetch:142⤵PID:6724
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=9728,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9708 /prefetch:142⤵PID:656
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=9724,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=10188 /prefetch:142⤵PID:492
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=9700,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9528 /prefetch:142⤵PID:5916
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=6968,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:142⤵PID:6056
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=9468,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:142⤵PID:3200
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=3240,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:92⤵PID:2180
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=7524,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:92⤵PID:2740
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=756,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9768 /prefetch:142⤵PID:2116
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5240,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:102⤵PID:6352
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --field-trial-handle=9744,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9804 /prefetch:12⤵PID:3596
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=9844,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:142⤵PID:5012
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=9252,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=8640 /prefetch:12⤵PID:6152
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=8484,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9780 /prefetch:142⤵PID:768
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --field-trial-handle=5828,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9268 /prefetch:12⤵PID:568
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=4596,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9912 /prefetch:12⤵PID:2244
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --field-trial-handle=4128,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:12⤵PID:5764
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=4528,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9292 /prefetch:12⤵PID:1704
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --field-trial-handle=800,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9740 /prefetch:12⤵PID:3192
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --field-trial-handle=9504,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9472 /prefetch:12⤵PID:1880
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --field-trial-handle=5348,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=10392 /prefetch:12⤵PID:5304
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --field-trial-handle=8212,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9420 /prefetch:12⤵PID:2860
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --field-trial-handle=7164,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:12⤵PID:1296
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --field-trial-handle=7772,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=10176 /prefetch:12⤵PID:7128
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=8328,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:142⤵PID:5472
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=4776,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=8284 /prefetch:142⤵PID:5832
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --field-trial-handle=8208,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9292 /prefetch:92⤵PID:6544
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --field-trial-handle=1700,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:12⤵PID:4904
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --field-trial-handle=10380,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=10396 /prefetch:12⤵PID:4672
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --field-trial-handle=8252,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:12⤵PID:6180
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=10496,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=10256 /prefetch:142⤵PID:4748
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --field-trial-handle=10348,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=10268 /prefetch:12⤵PID:5532
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --field-trial-handle=4584,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=10308 /prefetch:92⤵PID:976
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --field-trial-handle=10460,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9160 /prefetch:12⤵PID:2220
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --field-trial-handle=9516,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:12⤵PID:3980
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --field-trial-handle=7656,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9680 /prefetch:12⤵PID:2988
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --field-trial-handle=8584,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=8628 /prefetch:12⤵PID:8044
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --field-trial-handle=6804,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:12⤵PID:7512
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --field-trial-handle=7148,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:12⤵PID:7648
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --field-trial-handle=10276,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=8364 /prefetch:12⤵PID:8156
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --field-trial-handle=3676,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=8568 /prefetch:12⤵PID:7208
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --field-trial-handle=5812,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=8576 /prefetch:12⤵PID:8416
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --field-trial-handle=3396,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:12⤵PID:1704
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=9152,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:142⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3192
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=3568,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9092 /prefetch:142⤵PID:10472
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --field-trial-handle=8376,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:12⤵PID:12732
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --field-trial-handle=10184,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9752 /prefetch:12⤵PID:9604
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=9620,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=8216 /prefetch:142⤵
- NTFS ADS
PID:11724
-
-
C:\Windows\SystemTemp\scoped_dir1968_1177184272\Hide.me-Setup-4.1.2.exe"C:\Windows\SystemTemp\scoped_dir1968_1177184272\Hide.me-Setup-4.1.2.exe"2⤵PID:10156
-
C:\Users\Admin\AppData\Local\Temp\is-I1JBT.tmp\Hide.me-Setup-4.1.2.tmp"C:\Users\Admin\AppData\Local\Temp\is-I1JBT.tmp\Hide.me-Setup-4.1.2.tmp" /SL5="$110340,18133279,844288,C:\Windows\SystemTemp\scoped_dir1968_1177184272\Hide.me-Setup-4.1.2.exe"3⤵
- Drops startup file
- Drops file in Program Files directory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\is-RUECS.tmp\NetRuntimeInstaller86.exe"C:\Users\Admin\AppData\Local\Temp\is-RUECS.tmp\NetRuntimeInstaller86.exe" /passive /norestart /showrmui /showfinalerror4⤵PID:12408
-
C:\Windows\Temp\{72818D93-51D3-4117-BB67-D35DD19814F2}\.cr\NetRuntimeInstaller86.exe"C:\Windows\Temp\{72818D93-51D3-4117-BB67-D35DD19814F2}\.cr\NetRuntimeInstaller86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-RUECS.tmp\NetRuntimeInstaller86.exe" -burn.filehandle.attached=592 -burn.filehandle.self=600 /passive /norestart /showrmui /showfinalerror5⤵PID:1696
-
C:\Windows\Temp\{492F0F5D-6C6A-40F6-A0AD-099D4D250B2A}\.be\windowsdesktop-runtime-6.0.26-win-x86.exe"C:\Windows\Temp\{492F0F5D-6C6A-40F6-A0AD-099D4D250B2A}\.be\windowsdesktop-runtime-6.0.26-win-x86.exe" -q -burn.elevated BurnPipe.{543EECE1-8144-46A8-AEE5-3A8F67CADE76} {FD502745-0867-4C2D-9D17-903C604E0348} 16966⤵
- Adds Run key to start application
- Modifies registry class
PID:9288
-
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Program Files (x86)\hide.me VPN\OpenVPN\drivers\ovpn-dco-x64.msi" /passive4⤵PID:11256
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Program Files (x86)\hide.me VPN\OpenVPN\drivers\tap-windows-x64.msi" /passive4⤵PID:2968
-
-
C:\Program Files (x86)\hide.me VPN\hidemesvc.exe"C:\Program Files (x86)\hide.me VPN\hidemesvc.exe" -i -start4⤵PID:5260
-
C:\Windows\SysWOW64\sc.exe"sc" create hmevpnsvc start= auto binPath= "C:\Program Files (x86)\hide.me VPN\hidemesvc.exe" depend= RasMan obj= LocalSystem DisplayName= "hide.me VPN Service"5⤵
- Launches sc.exe
PID:8532
-
-
C:\Windows\SysWOW64\sc.exe"sc" description hmevpnsvc "Provides network services for hide.me VPN"5⤵
- Launches sc.exe
PID:11496
-
-
-
C:\Program Files (x86)\hide.me VPN\Hide.me.exe"C:\Program Files (x86)\hide.me VPN\Hide.me.exe" -i QzpcV2luZG93c1xTeXN0ZW1UZW1wXHNjb3BlZF9kaXIxOTY4XzExNzcxODQyNzJcSGlkZS5tZS1TZXR1cC00LjEuMi5leGU= -a ""4⤵
- Drops startup file
PID:7356 -
C:\Program Files (x86)\hide.me VPN\hidemesvc.exe"C:\Program Files (x86)\hide.me VPN\hidemesvc.exe" -start5⤵PID:6276
-
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --field-trial-handle=8292,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=9740 /prefetch:12⤵PID:12440
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-content-phase-1=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-ref:GROW-2836 --field-trial-handle=2548,i,6614627839806584680,13293695365518119006,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=8812 /prefetch:142⤵PID:13128
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --version2⤵PID:12360
-
C:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.25 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2b4,0x2d0,0x7ffd921f4488,0x7ffd921f4498,0x7ffd921f44a83⤵PID:7976
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4616 -ip 46161⤵PID:3356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4616 -ip 46161⤵PID:5740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4616 -ip 46161⤵PID:6220
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E01⤵PID:1140
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --scheduledtask --bypasslauncher --requesttype=automatic --scheduledtask --enableipv6 --bypasslauncher --pipeid=oauc_task_pipedcbb8f53eff625f232ff45d7644762171⤵PID:1768
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.25 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff77ed7765c,0x7ff77ed77668,0x7ff77ed776782⤵PID:6156
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version2⤵PID:916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4616 -ip 46161⤵PID:6632
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" -noautoupdate -- "C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm"1⤵PID:1976
-
C:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\112.0.5197.25\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.25 --initial-client-data=0x2b8,0x2bc,0x2c0,0x2b4,0x2c4,0x7ffd921f4488,0x7ffd921f4498,0x7ffd921f44a82⤵PID:5496
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4480 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AFC9E5377E423237B272CBACCE386CB02⤵PID:2512
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 68492E0E1D1F30CCE4B82F46DCB61DA32⤵PID:11032
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 746D80FA6C69E3C8758CDB6689F0159A2⤵PID:8992
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CA20BEDF96AD1BF785DC77E3835A8BDF2⤵PID:7028
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:13156
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 91E21FB837947B68A6765152CA2791A72⤵PID:6132
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 2108E8FD7AD1BAAE763A6A45BA358CBB E Global\MSI00002⤵
- Checks SCSI registry key(s)
PID:4796
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 756B0F91D70B946AF7E4511977F2797D2⤵PID:7900
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 4A1A320BDC7E78F85C99823984992C3C E Global\MSI00002⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:4856
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1140
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5656 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.inf" "9" "4e746adf3" "000000000000015C" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files\Common Files\ovpn-dco\Win11"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1280
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Windows\Temp\646d2e802336ea328be80214319507c5ddd27ad6abbd9697fdfeb03f5d447264\OemVista.inf" "9" "4281b164b" "000000000000010C" "WinSta0\Default" "0000000000000168" "208" "C:\Windows\Temp\646d2e802336ea328be80214319507c5ddd27ad6abbd9697fdfeb03f5d447264"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:12916
-
-
C:\Program Files (x86)\hide.me VPN\Hide.me.exe"C:\Program Files (x86)\hide.me VPN\Hide.me.exe"1⤵
- Drops startup file
- Modifies Control Panel
PID:10168 -
C:\Program Files (x86)\hide.me VPN\hidemesvc.exe"C:\Program Files (x86)\hide.me VPN\hidemesvc.exe" -start2⤵PID:10940
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD536583739fe75593b0cccc252124397de
SHA1edc8f750449e1fe16be197539e05621a362eab69
SHA256500d8644cd9b9e9d4fe236727cc08a873e2b0bf6bf1d300782379cadf2c9cf0a
SHA512fa5e6d51f38c0593903ef0c2322ece04ebe601293e3b9336f04de3456601b1fc87b6d0ad82d855ce2e2763ca6d83556c6659f25ff5fac067035f5ad0a9cc54cd
-
Filesize
8KB
MD5bf6de248175836bf7db30e5ca489bdbb
SHA1de74d8eb1f7c917159f6a61a83a2e3d80f544b98
SHA256baf9668457e4bb341c986ebd53fc708465985b4528e1e5d4f7bc18da93e38736
SHA512d37f339eb240b84b78ad0b149be0c1180b945d32ae89a02016cf4aeee610b66a1cd589072de34e6bbb3091567bd7b4f1e2d4a5e6f6d7e23ad7e38e7748ff62a3
-
Filesize
9KB
MD576634cb291b8b136dce4a4ae6db7c0ed
SHA1beb1dae5b28edfc91f7ab087219c85672c0d734d
SHA2567150cd8878ade36a22d815d08645da0c900e4cea7e7d267f47ace98866997758
SHA512ba00e091b4e763aff46843042f2d40382f2da20f1e792e78cd9fc584bf9244da12b560a14fb9ce8b8b16f0bc5c3afc25367482c27c0b7ca189e2988f49c1ee46
-
Filesize
90KB
MD582e6d92316fa920d36ce20c33b9335fb
SHA1e8eca4e6273b4939cf4e6cec1a91330d4be5aaaa
SHA2561a19ff4c3f919ee8b166b06f35a7234e354412b03b861cc06727dd4a459b7a7f
SHA512b687d041bf88455577e1615d7ebd307e94170d216ae1fe6ee8e46e47368ca0fccb01b675e82bd42d86374bbd66cd7c07d809857a953b3db287b566cbcb9ab407
-
Filesize
8KB
MD5453d1e17a9f574dc8ecb09e82868cabb
SHA11a07375823091bec657b8e66c1ca08c7df8879bd
SHA256c4126d6667bbb70622bc8ce27851a8eb68303678d897ca53ab86c1134d3671ec
SHA51295f6e58ba35fd121b8bceb8c8982054de00b7e40101faac7ab0e3c2a5f32d6b23f4b58a351874b7e4cf06094bb78ddfa3959a08d006b33429c2aa3e21a992534
-
Filesize
833B
MD5ab91b21e2f298b18c1d0fe291ec80076
SHA1362f9af19fbcc0ea23509b1a70d0e13a9a9b3e03
SHA256c96bc7702f57f04c4dd34f7e6722ac91d7cbaabb57ba67a42ab8308ac2cc6c2e
SHA512bf8e348609f112fbcecf3a6d28969f9d3593dcf7ad7d0579c1df46af17dca79be59360a12f1312ad9bf2ad4df58311ba1baab0d8c4dbefc34b7af250e8d2d155
-
Filesize
9KB
MD531c5a77b3c57c8c2e82b9541b00bcd5a
SHA1153d4bc14e3a2c1485006f1752e797ca8684d06d
SHA2567f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
SHA512ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6
-
Filesize
78KB
MD5f77a4aecfaf4640d801eb6dcdfddc478
SHA17424710f255f6205ef559e4d7e281a3b701183bb
SHA256d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7
SHA5121b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b
-
Filesize
444KB
MD543fd39b40ea11d06d9e14df4c698d59d
SHA1fd2ca29c451724037ee3bb5a0346fe0568dfdb17
SHA256572d713fdcea343e5b57240821710841afec5629519f36caec3967aac9595d8d
SHA512a7de91e9b8e46b4d10dd7b1d8b44dd744f1da18f2c29d5e1365d38f0a9253b2c4d6715889cc253c6d4855256a0db88f325be32e27ef1e26e7db6bfe91de6f3a8
-
Filesize
253B
MD524e4653829de1022d01cd7ddd26e2f22
SHA19160a009cb381e044ba4c63e4435da6bfeb9dc6d
SHA256ded3aeb5856a11db0b654a785574490cab55839ebfb17efe9e39b89618fc5b91
SHA512efd4bbba1baec0b47003831510e3aa539db9ef468e0f06ba9d7ba6d0b3800035f7c818d7d90171bfd377ec97d08c4617555bcff635dd83efceb412b1a9cca820
-
Filesize
640KB
MD5c13e559cf37f1e38378b6b1a3679b7a0
SHA19d55c41b13e70fe4c855f21dda76b0fb0fd5a0fe
SHA25636d352a52c85402c8b4cdc23832edd647395d0e22d6c07533817ea2f91d49148
SHA5128a888c054b09560fa1ffd6adff1a099a7606b43daef4d42caaa39dc18d11d869226ada3fa023039e796cb0af01c98c25a2f117bb5af5ad4ee6e6d46b3c066fa1
-
Filesize
3.2MB
MD54efab72bfaa350ff96c63923b5cfbf4d
SHA1bf1d81fd150b37ccd026f2c18da5570b19a85277
SHA25671b43324426195af990a7cadbc3b1ec1f493347f2870854d9f5ca9f1ade8dc92
SHA51249a28010d5f811fd76b98f2fe56b0a4f85bdb6eb9934e532bfe4a0aca95d4ff2d36ca7406ac48f8428da365a02fff2a687570aa26c24a1765cef365cea170b20
-
Filesize
738B
MD5b5a66aedcaf78e98f00a6875a85bf264
SHA1932b0f754e17b03d0d5597d61bbb27c35debd98c
SHA2564474f9d45f9610cda0e09ddbd2af673d8baecb83463e621f917c3ad47ff670c2
SHA512bacd903edab4b8a876031ae6e25dc0a281e914ad7c305c09175fca41ae60559372f5e32dd8e93e4dae408f4ec570b421314231c818ca32a361bb01ac3e67e933
-
Filesize
831B
MD5df73ba38fb7f428bdffd5469f239d919
SHA1ebb5aeda2aca6dd765e48e49fd535dc82817e1ed
SHA2564dc35441eb8724b5528998738d70e9a9816a25fc9d37a67e4ebd749b41b37bd4
SHA5126c7dcb290da989eb21383a6c4322f759ce97775c0045e486e632dae637b2f340d28b0c4bd5666ae19c3e94c85e2e37458f373561d9d8cc2dbb2a73a4207d55e7
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipilpceecbhfpflneijogboalilnfjp\1.3.3_0\_locales\en\messages.json
Filesize150B
MD533292c7c04ba45e9630bb3d6c5cabf74
SHA13482eb8038f429ad76340d3b0d6eea6db74e31bd
SHA2569bb88ea0dcd22868737f42a3adbda7bf773b1ea07ee9f4c33d7a32ee1d902249
SHA5122439a27828d05bddec6d9c1ec0e23fc9ebb3df75669b90dbe0f46ca05d996f857e6fbc7c895401fecfae32af59a7d4680f83edca26f8f51ca6c00ef76e591754
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipilpceecbhfpflneijogboalilnfjp\1.3.3_0\_locales\pt_BR\messages.json
Filesize161B
MD55c5a1426ff0c1128c1c6b8bc20ca29ac
SHA10e3540b647b488225c9967ff97afc66319102ccd
SHA2565e206dd2dad597ac1d7fe5a94ff8a1a75f189d1fe41c8144df44e3093a46b839
SHA5121f61809a42b7f34a3c7d40b28aa4b4979ae94b52211b8f08362c54bbb64752fa1b9cc0c6d69e7dab7e5c49200fb253f0cff59a64d98b23c0b24d7e024cee43c4
-
Filesize
35KB
MD5c6abc925748aa42b3f77152ae1e2d78e
SHA11c6cdfd3c7c366ccaee0e95945eda6fbfed2db48
SHA25610d6740df9b28e8a1d87ad08d4d8c03ae412e207440340005c03087a73856164
SHA512c3e42a9585e7d6d8e0841825c210dc35ae3f07dfbf60af7d3faa058fe2169d8c2e8281ee8ce4008c1cc2fc6f2a71a65ffbc214d8456d2ed7d06e10656ba19e91
-
Filesize
1KB
MD5c0636f2d138baca01dbb2eedb99bf3d5
SHA13b927899db0f3e2cb510782592887dc02fc3e400
SHA25610973e727e5b0eb3f12aba60a682d66e79dfd86e4b6cfc454fd8df70c6e1fa8a
SHA5120187a6ccb6428fb24ad4bc4ca14e7ce6f40ae6ca4f352f8e86a15288deb05cb4dd317ef8e9d04dc9ffb24407ecf0924af2c7910830c79366f7e4e48cb4b82b1d
-
Filesize
152B
MD5afe63f44aa3aa9393e4251b4b74226e3
SHA129eef15e4d60afed127861deebc7196e97d19e4a
SHA2567787181844d106768f78847869b5e784f07c1b65109d59b46932979bac823cd3
SHA512f0f7951b5d55c2cbb71add5ab0c2ed3617a6fdf93f2c81ee9dd15d9f7c67881b42cbfd97cc4d2f17ba8a383624b23da1897fee069ddcee34233c1f625062a1cb
-
Filesize
152B
MD58b0c53c5fe6ad2ee4ffbde1b3384d027
SHA10c9ae4f75a65ed95159b6eb75c3c7b48971f3e71
SHA2562e9fc3b050296902d0bb0ce6b8acc0bb54440f75f54f1f04ae95c9956108171f
SHA51229f62e085d685d3b4902515790ab4f298454d0f8d53b6234fae9f9a0edffdd0d4edee57261e8eb0b94a4af8e86d3f7ab8b044c6f259576b89f91183002e58b42
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\36941ce5-c200-496a-be9f-158c1a28ff13.tmp
Filesize5KB
MD5a4adb20dc8000516672337d5f7671e91
SHA17c14b2a78f73d84f3681f17542ed2e43f7fa263c
SHA2562ab86dbf899b73e64c579599b7fc8b6bbaf3c221f5a2d297b8ca4c0b6c1a3734
SHA512b9d414ca59fa8eece5f39eb4f54a0a48cc22f155bf2a902be7268023b29768bc43aaea1a74cf915b106d138168c0ad7174ce7daa4a8a3b21ad5a425fbc6a9bfa
-
Filesize
211KB
MD5151fb811968eaf8efb840908b89dc9d4
SHA17ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA256043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
SHA51283aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
-
Filesize
24KB
MD5c594a826934b9505d591d0f7a7df80b7
SHA1c04b8637e686f71f3fc46a29a86346ba9b04ae18
SHA256e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610
SHA51204a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961
-
Filesize
20KB
MD57f8965bc4a6541189bb000b832b3ba4b
SHA12cfc6a12844c3ec89d571ec5d87cdd5a0cdc26ad
SHA25657e9504e17918efff5f382ae00f64cf1203fbc3190adc3774f43f49a883a16da
SHA5127763d57e238ff0cf43550cada4c6d941a673e0e9ce8020e0b6b1a99af54217c7180c2354edf9138cd50461c07de5e0ad09527e3fc7ef87a73003ac3847dbf306
-
Filesize
63KB
MD516f6f8ae2aa57162237d4eb44a7886b4
SHA104d5f8f5f611bb22044b49286ca1b26275f5a7cf
SHA2562a2e88199811f550151ecc39b0a9eb3a218ee99b64e1af23696fa120afe6ab1f
SHA5129f53942cc3976bf5a11a5502bf688809923a7f82276089fbfd0f96fbc998998be4f424b9cdd4c9a214588f80eabb37840622cab48d8e96313eabbb395747721e
-
Filesize
30KB
MD56fb26b39d8dcf2f09ef8aebb8a5ffe23
SHA1578cac24c947a6d24bc05a6aa305756dd70e9ac3
SHA256774379647c0a6db04a0c2662be757a730c20f13b4c03fe0b12d43c0f09e7a059
SHA512c40f4771c10add1b20efb81ee3b61fc5ede4701587f29a1c2cdde8b6faabd1c76d769bf8b99aa19082012f95d99ba448a472463fb9056acd2e43542e14e605cd
-
Filesize
31KB
MD52ac2adc84c927cfdf1f89151c297857e
SHA1522d8d73e753ea521df7aab8b5f1e41c63c257ec
SHA25696a0b135180c93ccda53e7d9f9181d490ca6c4ba8070d68bd7877f4d9e7fd4a2
SHA5122008bb873013340544d22f622359ae325d99d9f59ab50c9adef33e03374497e744fa5cdf73ade9a8039e7e3ea39ea566fe4afb4bf6322713ec1b5139cbbc4818
-
Filesize
223B
MD5ffde06cd96c006a1f80533813065b7cb
SHA1b9b159362b32a3886012d254fafb336260b80b2a
SHA256284387e3a56917583c6229dd120c847a3682ea6f10c330ac619ad6bb8e83fbd8
SHA512e0acd597d3116d6f258fde059952e0506d29be218390c9d77e5799fc8ec97ea3e24359df19a18c410ace73cd1d4a3a76668497e48805962ce791f260c27889fb
-
Filesize
1KB
MD5950963da8cf666ad1897c41ab5b89d15
SHA18e32d39165eb43060ec30e100c3be16498428ecb
SHA2568ece7c6d2a1534506088f7fbbe1eef8cff12b37f3531aa9c472e875fd2a294fe
SHA512578757b0e6482cfa9c0d1cff4f04296042f65cfde2471e5ab5525b9f4ddb4580640411a1258b035e839a12a9890a2336e05bd2fcfe8304d50e96169841b85b5b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize816B
MD590f743b2670bb8777993423abd540448
SHA1f39630a447cdb5b3967e9df560e596b3f899a0fd
SHA256cec8c3fdaa48e65d772ecc6fb40072a08d0cac9bfd57e1d09f2b62cff2d088ea
SHA512f3a709b538a6568c9d3ce04220f55d37884e220705eee858c8f486fb10ad43323ba5dc225af5cdd1580fde64d641f001c87bf0959a0a73d6622bb6da0227d9dd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize600B
MD5e962c2666f90ae137d12a29a01484c6a
SHA198e64f277444dff831f52d555efff520bfa9288e
SHA256bf91f6ee104e3bf198b9254354c8b8f171960ea2b39564810d6fc870cd5b56bf
SHA512d8b900aa0134d00a5b633476422592f9f7303dbd45b80147222c3123c70fdecc43d6b80e6184de0d037bba7bd9420473a83bf96d0dafa6589e12b9e097c41a4d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize672B
MD5ddd3a1fac51c0cd73bf221e9bef68039
SHA19156adfa9af5ec75926870c273646a081ee03e9d
SHA2565b8939baa4abb5b097714b1978e4c0974b7fd03169604afcbd737f43e3f48589
SHA5125fa0fe79a8e20355d9442e2eb1d76fae8a958b60653b14921b953e2ebdd0bbe54060a0b52ff1eb4ef0d51f23c6665abe3f002c1734e961abca2bd02ad829064f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD55316c9db4b5d4fed73d6295cd2943e27
SHA150a559d564ca73c401d60f49587e3e45fec5a312
SHA256b8252c8843812260ed30af81f2a2b727f647c64283d5c0b715d2e2c8f7ece2b7
SHA5123f05eed9350d2d14e3a47e2c53dd4120cad4847588a57da2a7b8c00102b975d232b8f4f2ecfc4b5350ff0a68b4c69eef6f7db88dee2456d44794b9bb66f68b08
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD584c748e95cdc15d38048c275428815ae
SHA1f8cb6a59d7a53c01282df22a0601c8c8ec5dcc41
SHA256711698d77aa246a1e297df8a3f3d522d137bade1f659d4ca9792d1c0f31bcf5d
SHA512a73bab685004386f8218efde0b3c57cfe7c57be89fd7b99c498f9d4eba5c90cd26771fa0e200cc4061cdf0d3ad7709f37cb7cc10d5e38598ce1b166e14d7daab
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD55be968c8b7c0cd3468cf864299b42bf3
SHA1cfa7b8a3e3ed85a06d20839525f2d45659479c1f
SHA256fd92e06899196463279823a29b7ec6710d5059ccb159f6cee88de0d7f7048087
SHA5126026705704342c24194600d4dba60af4a88d0e1c0d20ee88bf43ecfad734e9d0bd47eaded0942196a03f4dae97f3f41e61b4b30a6730897e0d1c66b6d0e99407
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD53faa324071b753588b5800d8eeb1b850
SHA1778bb58a0a6079d66014ec334d954ce9f81b51c4
SHA256e052ceb44057742fb9bd841648fc5eea079315381f5be9a333e4066ab8e6bc29
SHA512a13d46901bf948f214e10f203149dd98cea5b926698cb1b3d17d939203e6c3c79fc2b024fa1c8779a0c5844d880d986628aa21cd1b421afe3b6e0cb917ec51b1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bnaebcjlolajbgllgjlmlfobobdemmki\3.8.26_0\_locales\es\messages.json
Filesize186B
MD5a14d4b287e82b0c724252d7060b6d9e9
SHA1da9d3da2df385d48f607445803f5817f635cc52d
SHA2561e16982fac30651f8214b23b6d81d451cc7dbb322eb1242ae40b0b9558345152
SHA5121c4d1d3d658d9619a52b75bad062a07f625078d9075af706aa0051c5f164540c0aa4dacfb1345112ac7fc6e4d560cc1ea2023735bcf68b81bf674bc2fb8123fb
-
Filesize
330B
MD5048b1de3f19a4799e98423d985c2d493
SHA1e41ffc0aa7d920b6270e4b4042e61bf7b2d588da
SHA256e3d7f9b812e34257c2fbeda4de3b218920414a0629b4c43166d7f31ee3a8411a
SHA512cb5dc6a48dfadeedc551def5e051861cf61b16dec71d06e7ef5ec7a45e81715b0d8471b9e3af766fe38ad919585ea39b023a8c888b3b15f01fb794b5b35d7838
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ify.ac_0.indexeddb.leveldb\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_linkify.ru_0.indexeddb.leveldb\LOG
Filesize11KB
MD5dbab772df789dbd41db457b64c0be1ec
SHA1964dffbc579c61a16312af396e303296970fac6f
SHA2566c8f4191f986f55ba95ef0695fd687e3204d3384376d38141c03fcf390abf708
SHA51256747f1909001ed0fcc0efdf43a08c71255c67b058e4fbcff7e4a388efa0e41b4869357f3316742365e0cde0e335076c3305b7805f749c4b48fe1b50b46abd0d
-
Filesize
3KB
MD513964d433aee02be0f78a75a392f5d42
SHA1e50a0d67c2d00942601731e7e21c8109859e142b
SHA25643088eaab997c3658b5df81de5042316c13c8786fd0490342e9f7938f9c64568
SHA5127371dfcdc2e29001430649a09a3883fb5221fa0b835c0ff4f644c23d65fee24ccba70c271c086e9a01dd0decaddb85491a527841ae2215b867529e2ccbc24c22
-
Filesize
13KB
MD5efca26c7def8495bcc9ec176a6f31522
SHA1fc6e63c543517df8b8450e5d46d3d8f6799526d1
SHA2566a399afa8cf8577a1bf4dd870ce4d07c51bf68285c2f056dcc22608c97108d6d
SHA5124226bb9450779dab90bdc59d9e5b5d09770334f8d6fe7bbed05466be071ad1f499eff674937ec3d63f84ca4effa3be02bfcc646f0d6a62d754deaffd4a63c743
-
Filesize
2KB
MD5624beb33b1d4092484fc6200b2031969
SHA15b500c0c7cbed4acaabb3db66342a040a95cfed9
SHA256ec6db52a23a763fb9e7643d53d8d41f1d3a91ca814930c867514895ac2984e5b
SHA512634b378ceca4680d339d8642fe898bc0ed67225e18b0fb056110ee3a1b59026f4dc0aa50892cb69030197af976186be6310a8be1ab9ae4a39a5c4ba32c877133
-
Filesize
12KB
MD5dd5631f0378deb539d185fc6e0fd7b12
SHA15644b697a7e69ba8aeb359309f4994f0509f700a
SHA2568206f4c04295b78e33e343657aa6a27d6aa7b9c13fd4bd791a6ea30528b97053
SHA5121f46a8ad6aa49229ecea696efb37e19976e6e04e72ec845dd0d56306b3760b2ef605f007addda947d733e65f638d1e59bf6a15db14f8b939caaed07568b7cb91
-
Filesize
3KB
MD519f136fee0e7c337a904a84479c196e5
SHA1f9f26705f2aa5558e6a47c61398e0902398b763a
SHA256677c384fe5f38b1fbb4052c9e7849c12418d3ba8f0899f3704aaadddb3a9298d
SHA5125f2ba10d7e9d72c64c252f8ba8b613993f287062e90b81ed4fe45079af5ae78c0ac1e1f65907d24ca1c03c412e3dea12aec173afb14ae087b3280267981a3a7e
-
Filesize
4KB
MD50cee0149778fe30bec299ed587d9b2f4
SHA1d4c3f530481d927745d87e87c5aa7d9f8f7dec1d
SHA256547057b2d78270f11203b5e415c6bd42ea51c3d7d1e4eaec197dcfefc4492bb8
SHA5125da7d76c860ee7408b634974eea46b9100c43f67e25ca1d03288630672040f5dea982e53d8dcd04cc7e387d53ea6416b5f2a68867f47bc74135957bf186d9679
-
Filesize
4KB
MD52339a42cdef33d228790109f6aa4ba8e
SHA13849045f80260b88f146537e9338a61293420815
SHA256b0ebfbefa81c793f33f2303096b619e3a16b9e2c210e933f248d1705c31f7d50
SHA512f99bf77d24aa509dad4de34723ba880136cc226dabfc9cd1cae4de1199ffbae33729c41ac6f99e876988b7c132d8fc19f8135d74a321c911320ec20e6fa5afa2
-
Filesize
4KB
MD514365b385807ce96976659fc301df791
SHA1c4a44c964cfc464c75c6d6746c21a765f95fc7e6
SHA2562e375ce61e507ed7bfa5e7a5a32ddc6e724669d8dd2fc11d04e2cc7fd06cda2d
SHA512c4419febe5078df9ca1e05436b016a121c3dd45c7ab1e91f1613c73ad132ca29d1201e01fe2fe4b606d623bbd0e5a98d29b976c9c1f7b1ee6b657ca369126a5e
-
Filesize
13KB
MD522ffdc1f7a50244f776e6db4ba9aa71a
SHA1e041c8ae6288269489ecb62682306ec1ee644831
SHA256e123d20fbdf2e3d3149d904cb7d84bbb0c8fa4fee4f87fc74a913b66fdc5524e
SHA512da2541be805d129b2258c386644e05e0fbbe94e63f7c8e6b31e5dafcc0295003802103758181441666bc516554cb6de8a40229dacf09e5856d534e5386a0ecae
-
Filesize
10KB
MD51b6c9bc8ae124b7bc1da09e085adf862
SHA18532935e792c567c9227f767e2ee368710a7478a
SHA256c4de7d3facc27ec9051499fa8cfccd9e6a436abb6fa65136014ab8c29eb564ee
SHA5121a929f9fbdb72c766c30a2927a1744a923fcf98b34bf03450ab4515b2ee3658f22ad179b1437dd06bff0393f1e31a330b4e741f577fc1fbfca1b9a2df26d6e5c
-
Filesize
16KB
MD58e314b98659093018f93b9ced0830c43
SHA19ec83754f1c95896f79a3e74c7e9748c6803abfe
SHA256bbdcb931c26ff10ed412b46df40033c5e5a867986c32a9e13b36b6bca16325bf
SHA512ed042cf0050f71325b43575c5d315439ad362631ad9cf310cf50d1bd7130b9e5ec5b6b492199649a98ac09c9e82b5a61df40321f9221cbc0434dae5618c0878b
-
Filesize
7KB
MD5207b1be0c5533ec2d3b2ad37124e2335
SHA13193ca763e2dd3a1eef07c1b80b4ebca3a003cc4
SHA2568f7ae02bcf524b2227dd41d8ce5d03337f4e47ad69b71b1a175f35040bf877c3
SHA5122628ab42b0e40ee86f24201feca2b3c1ee92bd2b2d6b21b01da2f86c62ea35b76cc34b69052bffbe7eea0802258aaf9092af0fa96833d1d987a6bf513205ee8d
-
Filesize
7KB
MD5b2a6c8273bb31412a93bf6d211f9b53f
SHA1cb61bb1c9534c46e73a3c13ebeb99cae13532162
SHA256934f10e438de8d752dcfed322eed7535b53619ac5a5518853a3ea3fa97b359c6
SHA51287c3dba3b0daf1cc3d122d00ff882357616c339e12b63b81051773e5c04e257b49ad874c76ddde6071bcedf4ae94d07d49d492fffb67866d6af622963291e6a0
-
Filesize
9KB
MD582739a6414c46bdd42a630c8f1dfe331
SHA12c0d516c0e575a698f6c5e9d6aa1a2e717de05ec
SHA256062c646b437a7c2ccf9e949ad1cf55f0d8702f2ab4f5bc85d6f6ba31a5a3868d
SHA512d0616c081f37110971175d7126a402fdb536f0e389bf34a5068770fb088b1c0128477e31a6cd44dcd8ba952f1395ecebbe1e81e4cd4834aab710382856beb952
-
Filesize
9KB
MD506f165d319ba33f0dbd7564ef1c8c8a0
SHA1f4b614941b0c1d2963868a6fc983c88fbc520913
SHA25620ab96ad36aec869f7f20f08ab4a966058a4eb3db899d240d7ca3a7884c3a129
SHA5127b17a2fcd10ac7a440e19af50aa7ac998648ef768686d114ac06d0987014b291beb6610071fd3b4e01c3e08c10f1e160509eaf5ae499ca0d719347f8ab08196f
-
Filesize
16KB
MD54c315e6108f478a839e2c12e16bee326
SHA1f4ae338b96106711d6f11f8b2840084eb11c01b4
SHA256f899c5321694bb73f621c81db65b9369efecf8fb983e82df6c1ffad62a0d7514
SHA5124b8f088f853d1ee753becc66b2d5adec0ed3506d9603066d4252ba6d9deed63be0201beb83513946f00cdf8fbb75867296f7081ce2a9e13ca1e48d8552c576da
-
Filesize
17KB
MD583e3daf527a6fd36257b4de243c1779b
SHA19cd3007b7f53a8584fded7a2db620325e12fa813
SHA256a51bdc7ca9ff4cc2a34b52fbc447fb44b8c555f8cbe990e8a3d05e3986ec4995
SHA512d2d1252a5956bad09ff570375433ebf81465f000b56a9e0a84a48b5d5b707b97b5864405cab7d107cfea4cd2a58e82a7ace74506982a73ca719a76d07964b5e3
-
Filesize
6KB
MD51e4dafb29a9e968cb42a5e89c8da3145
SHA101b852c5fac246dfab936559bb3b0c8335f56099
SHA2563812ec067f18f0abf04370705acefa15a8309c7169b64f6418c73713ac2bd469
SHA5124f2e172e03544173ad7f70d34d1e79ee3564f5bedac3a0dd281e7e8c4f49969bd4c9486bdb9d7c6a952f5149e300ec83cbcb4c03b50d5f65aab05da0266e0748
-
Filesize
8KB
MD5650e9ae806276b97d8f9c5a0e63be23a
SHA1bd8747ab8fe7cb862193a8ed740b62303a33afed
SHA256e69e933834c1cf998dd34431e024526d11c4c79464c913658b5c22cfc8f45b62
SHA5126e0f4486534206da3411cf6c37cb97a4a798150dc7f29d58b47b4c7829875bbf5e4fee0cdf852c0fbd9b733b792f40be2dc4a232536e46b4df58501563f0b00c
-
Filesize
10KB
MD57dcd694195e8caa7316d2e682df9da3c
SHA111aeddba95d71ce0cbbdf582357fe9f89989a13f
SHA256c0be5bf0e78dc47db2979e46cd85a5d1306a42940e2a2441d5b5d1ac8c2a19aa
SHA512152440021decc523aa5344e627781585a25b5c0ceea0273436ca2a91f56c85599e3f9acae5cc8059d8dbfda4ea28f60591782b91ed032dd9657b696531ac31fd
-
Filesize
9KB
MD59621eefdf221a75f57a7823543a1c965
SHA15bfce0a9efa7284604068d622475e6ba2ff42917
SHA2565d37727bf38fc0c8dd50d28e802d8979a09e562e951fa92b0e475e32f3ca2636
SHA51234facbf93d195f90b91c21d2b94534d6056d5d718a272601c933fca83d390cd392c0ef689f7f5b9093a56744fa70aed9271afe93c122d8c46bdcdfcedb98465d
-
Filesize
9KB
MD58d563dae0c1b9d7ae9b0196aa4cf08b2
SHA1243355323d4bfae8d2e66c8a75fee9e730f857cf
SHA256d22b9118430cd3fd931166881b2e68c01a9fc3d04880d631af5521c0b916d7ba
SHA51280e2353e1bd694ef8cc19fec827586a5feb1cde11274180d20cce4d7cb4ba444ddf2931bda599317a772181641087e2f8077b3ea4bb61fbc2ce86ec26bacb359
-
Filesize
15KB
MD5f39ba91c8f56e65eed16a3a1ebfc82f9
SHA1199ea3355366da0277eb6241476e3dcc36f301ef
SHA256a84aa1b2ce354af9b2e1c2098cdbce2c846f0cbf36324e652381b03b9c3e3549
SHA512694f4aa006ee4eac6adbc941b1ff44dfe477bb77a2c05bc48708ab81adf6781dd917cc70eeab4410e70936f4b12a9c8a0e074b92e9049183dc35ac2fcd606d36
-
Filesize
9KB
MD5dc5ec1bdb814d6229d271c506e334ca2
SHA12909a00f2b268f6bfe30264a0332b8c196469ea7
SHA256071db979aab99c4a4900ba6edeb9a8dc8da75f1a423569239a2e8729214724b2
SHA51251f1ccd522f61eb08fad90dbae32d2e1863050506ec187ad8cd440608f9c40102b3486be23016a81ce87024a4c22ef7182526c1c5e2355b4564718db81b96f77
-
Filesize
9KB
MD54125db18b5ab02dce83fc07d864fc0c3
SHA1cef5366be2f2246dc65e9d6a9fb89157ea381f75
SHA256f10c538dea8dfb056d6504295a1c2e46ab4392b3e44d63d2ec921ab50e0d2f95
SHA5120c204b383e998c024e2915f6fb7579f981ed2451309cb0b1ab2119e14fe5ad5a0dd4df65ba610fc6eccbf1bb6208ed7711b612ff90d339b02b56181006cad7ed
-
Filesize
35KB
MD5cbeaaa2b5acb7813648334d4f04f2e45
SHA10a99c87dc65d7f8e534b2ef07214e9158e98caea
SHA2561f4f3a8702a3df8afc130f5e513ffb6135bcc931d39e3fb62f5004f01dfe2674
SHA5128ec8a704959ba7f3354394b76c4fab117a4297a88ed36604326e46f7bc7b174e3592a38e030030da6539528f22e5ccbbd9256d2fef53b4b64ad61bd4101d9d3f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\153c102b-d7b7-4657-a99c-f8860a1695a6\1070a355d6f051fd_0
Filesize37KB
MD55b79b68d721c185633c6dedc4296ea0e
SHA1e954e3b1189fa4c4bffb60d3f8fa769e7ec955c4
SHA256a1617def0073612de9537fd7353177c02d859fb8995c377c16819b1803443838
SHA512868e7ff19fa3eed4d514913b04d5c087823d3d325f4f341f01757364e1a2a434e17fa8951087526f3ccb94d380fcf8a0ac6d70024d23daf73ec0941c93667728
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\153c102b-d7b7-4657-a99c-f8860a1695a6\56150d07469570d8_0
Filesize37KB
MD51a4c27dad5481b7c723db4cbf10327cf
SHA1e2b1a057d4997e1a8285eab643a058226478cc33
SHA256e59c989d2bcd8341977aeb1ea452584caaa7a3ca84f88883ae1ebf96bca48f2a
SHA5123aeca2e6aa2fe12206f17312fc57eeccf34aea230a15ab19eb48c06558c5b7d132dc1799c1c56828ab0cc78f2cd0972f4c3a70bfe2ace7ce356a2305a13fc892
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\153c102b-d7b7-4657-a99c-f8860a1695a6\61569b19acc3d264_0
Filesize22KB
MD5eef2ef0841e07353eab3c2c18516a25a
SHA1730b955dace52cc94e0a109cf7212b85f52e533d
SHA25670fef9a23498f0025a83516fec181fdceb452affc9bbd866a289293ff693eeca
SHA512c93e46bfe6c3d5929548ae003935ae4093b0d955c0d51ba9f1dfdb233436c89a9389003aaebc2e8aca4e1ca3d2ce47784f92677a671a56401c2dca82aa02499e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\153c102b-d7b7-4657-a99c-f8860a1695a6\6293ac4ed95b9d91_0
Filesize37KB
MD5392c741fa38df8d480f6a3c7a39cc434
SHA1bcd1c1b0cee38ac281edbb6d6a3ee32d25ac6173
SHA25692cb5d2371e5b23160c0959024b458413ca118c8dad28e0de8775513dc6934bd
SHA5128db134bc68b9436f8748f1c7c80dcfe7934eafac84df3d0395205680198130124d9b2860e91eab706a00352f4d0dd97f6e7b2e677ad70f9a680a18b11b0e4e18
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\153c102b-d7b7-4657-a99c-f8860a1695a6\89537dd68c24e917_0
Filesize37KB
MD5a953e0c197cecd07ce7784d3b2726ac9
SHA1ae1ed17f052ad875a92f13873de5cd0695deb018
SHA25634a8d91e2ddb8efc3674ea00b921410eb86b8e3598d6ed62ec7d61cf6344c305
SHA512f395073aac99df0f89e135ad083ba2b4a740e2c14e95426f6cc61932e1a8fbe238cda62cda81156d3f3914fd87b9c836eafbbcd2f2d2bba895361970b6ce25db
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\153c102b-d7b7-4657-a99c-f8860a1695a6\970bb02281f0099f_0
Filesize22KB
MD5b6035b638c7a3882ff5559a0c2b68be0
SHA1ec55d7da78e3b446988e66ca16ab7e27c7db3fc7
SHA25631a963c12403562a212c8fdf1cd717ad9be76103854f2781739c8ccc57de255e
SHA51201058a19df796c44c8dcadf698fc73fa5cb96aecc51f49bedb1027400e3e7086e8af9361915f1e8e9392fc59e093967d4f37860e7e6c1c440e2ecfc402090ea1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\153c102b-d7b7-4657-a99c-f8860a1695a6\9f6bfd145a8c2fe3_0
Filesize37KB
MD55c8f27ff53a8cd0a520008c0baf1aa60
SHA16cfa8a76fa9024bef2a4e702f567dcb15aee528b
SHA25691c29b5cbc555f677a8ed3d00b485235f78f664b508375940b99e00bd8a59bbe
SHA512d27f49315d90be4a8654492e4ba07c3f55adb727a77044717718c8b36818384a81b619198843948b581d900c685cfc9c6c370a2d0c098b2cec99ec1796fc1b3e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\153c102b-d7b7-4657-a99c-f8860a1695a6\adc31bd2c6cf9bc4_0
Filesize22KB
MD50666d6e790788ccb128ea0b9442e7bc1
SHA1a4b52077a08b2be34c33b6d00dcc86170d178176
SHA256f429dea0564fa9225ea24b20ef17560128621ed95dc068d15345b2de4b07e317
SHA5120618f716b9217ecde7d9008058b73fab624f971b7a13caa525928b7d50cb8b6f6bc4264442e2444569ba8f6fcf18f8489931cc380a97cd79507c76a17b6b26fa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\153c102b-d7b7-4657-a99c-f8860a1695a6\c575060226d21d14_0
Filesize22KB
MD532fecb4ceab9e86aef77135ff49c7d41
SHA16aaf64d87551a57699f551fc3987a32f8112a02a
SHA256e8cb296af44ca2fe6f40233ffd7e7970ca1574cd139e304b74515ab670cc9110
SHA5120d0a44f334bf9bff0d4a553a95916e352bf8403b9dc548c9509f90fae7438a95014484b3fe2b6be1c55c8d2f7d02fa8f1e1def98f885fdbe396ced65f254855d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\153c102b-d7b7-4657-a99c-f8860a1695a6\cfe2a722cdc0ada6_0
Filesize37KB
MD53e080b8e3cba960ede2447984652b487
SHA1eff2a3a54316d9b4252e1ee80cca61f770edb804
SHA256bfff8268c5a63d3f800a0041c01c811c0b121d98fe350aa0c32ce2f067f889e5
SHA5125ff1d9b266c8dcc42a591f2a603290b098bdeabc2b1c92d15f97b1ed49d8521613d0bb5f70a545f84a236b7d73d9632cd159b1e471adefd4268c5d3ca1665172
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\153c102b-d7b7-4657-a99c-f8860a1695a6\index-dir\the-real-index
Filesize144B
MD5626b133bde5c0c462858278235cb57aa
SHA119304b318bd3bcc424b1bb7d6282c4943214d04d
SHA256473e743098a947b3faabb761f907852fb42a9f3dfe46e55969d29f292d558026
SHA512d4afc5652af60f8bb449b18dbe5d4a4cfe88b4adcb358ddb7c261b470952e176db3d82e9329431e257cbdcbff73ca0673e866fd02b8302ebc9f39e6425ea6b06
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\153c102b-d7b7-4657-a99c-f8860a1695a6\index-dir\the-real-index
Filesize240B
MD57a2bea35bf3e8c093ba4512f6f06c1f1
SHA15c12870002b86950dde7245cb75b77e4a8308b0a
SHA25600209b1bcb616131b004710d2743c708abb3de46f15f61ecfb568b199e68402d
SHA51225d07ccc320134dc547b9790bc8fbbb2fd72cda92d4c4d1227befe309e7bf4e42a4ef15d70d62f9b42d2bd3f929c542c803655424babd51bf6d2e8c2cd5363a9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\153c102b-d7b7-4657-a99c-f8860a1695a6\index-dir\the-real-index
Filesize240B
MD5b6f213b47f826dedaa3725a605b796a1
SHA1b9673dba1d7a07c67630170fc76fb83196728ba7
SHA256a64faa258b163ef0fe87da793cfd38ad8acf203b261da0b40b4702f31d2e6bf6
SHA512470c35b5f454c58361e06509c10b728f3f047e6b946e2d68ab9ee4d675ef3d318823296176c2bc4a3411e10c08562fae89cccae1140f371dc7a5c148d6c01cf3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\153c102b-d7b7-4657-a99c-f8860a1695a6\index-dir\the-real-index
Filesize600B
MD5bfa69deaa7e8dd241bbc1d6b51ccb416
SHA1fd74d3b95e1de1cca8586ba4f6c57d4acfe97015
SHA256a35c09e78bdd5054bd9e5be8990734bd2120abe0aff58fe44dfae8d30739805e
SHA51275e1ac5012db70d795da44f6bafdf5cb2de294f7ce3359ae212253c260dafaa6cb4a592b8509b7e73cbe3f919a05930295f76f03a103a8df3076d8bfc3768b80
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\153c102b-d7b7-4657-a99c-f8860a1695a6\index-dir\the-real-index~RFe5aa29a.TMP
Filesize48B
MD559b3df6e527641d9f933a51ad86de7e2
SHA1aa5c7c0ed5a141a4d4401d7720128e0b4ce5b22b
SHA256e24bf4a3645aaee883259e4dca20ef88c42a0f6f297a270d856fc599f8bcfd8e
SHA5122a8835ffcb5577969a01535c8c7246e84723e1d13988590ee1033b92e842be9d0463ad35642c428796368cbc0f4c05cc9fb80b3db0cfb9040da4e26a865dae82
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\153c102b-d7b7-4657-a99c-f8860a1695a6\index-dir\the-real-index~RFe5bb8ec.TMP
Filesize144B
MD5908ad9ee40b6b63e4d7cac3c5452323b
SHA102cbacc4877ad73baf2a87d26b32ac71dcc58fef
SHA256b5aadc3aac082164f5e0a9f3c55a21526313a25279c7e91503421274d248061d
SHA512c120fe17413e71753637af82aad4a0cb9411e386eb6f58b31fc3ef42eef587cceffa9221eae4a606ab4ac40df8887947c2280d9c1ebfb6de7530d5706144f960
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\153c102b-d7b7-4657-a99c-f8860a1695a6\todelete_72a115ccdf2bce06_0_1
Filesize22KB
MD511fff6b16145def82852926124b6d599
SHA146b7edb536fc7ab51e2adb3d6378fdb9c684f0ab
SHA2565ab4772ca16ddc3579f1b45fcba1197541292e9f5e72920aa8b0a4dbe214c639
SHA51265cd1f5f7e700fd20fe7de892f338a05cd1e50be057d4b51c07b1782c858cef139037c2eca777b21a56ec9c0a8ae779e7cd8a24209a60fc0a5573b51d90eaa35
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\26dc6b53-1826-4690-9d62-df1ffba61e30\index-dir\the-real-index
Filesize96B
MD5c2684b56b1c8c716b509376d3b11ec24
SHA1688c6db7b059377ff4f411cddb2a2264d83d2137
SHA256605faf2ef60e9be64ba0c043a013d81b360038c65d2389e4fb691d31a56a6ed0
SHA51283603cb9d2ea24e661a2b33a55e0d92582ed04578c2c3c10bfd3b5b299481084c7eb36559642c3267ba680bc795693a6f0effd8eef24c9811662a00698089b0c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\26dc6b53-1826-4690-9d62-df1ffba61e30\index-dir\the-real-index
Filesize168B
MD59626e461104644e51b52f198cf777506
SHA1e87be16439e0a462d498b07ce357bc57a29d85a0
SHA256adc06c470cf97dd53592ba8b02216a99900be39c6a1b376552d29784c5f172b1
SHA5125063f921ebdb859643fe2d97007120ed4348b637e6bddbad1b7813407ff5d3e36fd416f06cd4f20899955a6170d55245a5c3b0390f50b4f47b6149a2a9e6b6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\26dc6b53-1826-4690-9d62-df1ffba61e30\index-dir\the-real-index
Filesize144B
MD5e9c206652026aca00ce2d571484e3f11
SHA15b96ef5e511ec6c04ce2753418658691f8c87569
SHA2567dac00849e9180c61b9b4c21d7d043d7fde79dbf82083ff273e46d57b6d00744
SHA512acfb04576c248e21fa05af223b4d1f5eb66e150aca05170d45b9e6f3763b113a6bddb08d05eba73904deced468f8a1caf7c6dbfd95e0139d434544e73e5065ff
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\26dc6b53-1826-4690-9d62-df1ffba61e30\index-dir\the-real-index~RFe5b6c72.TMP
Filesize48B
MD5b234812b2dfb9f34819938759c61eeb3
SHA148c03aa73080576cfc0ca8ccd240c6ec5d0cbeeb
SHA256bc0b5806ea61a7b4b045a4d4f5a2c1a7b7d24bf21a56fa3073c7c72017eb3a39
SHA51221d7178381587ba8146f94b62fc08f77a5a5d91b6e4e9cba20f07c76a1a75293185c9761dcc236bfc6cca04c9856a4f344a634fdba2b301dfb1890b5eb494974
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\45c38980-0e42-4318-9f11-befd7617a078\index-dir\the-real-index
Filesize72B
MD5e0a8f8a9729de745c473b1a0980346f2
SHA114378c41c6fe3e90cf7f4a375531f76dfbd7f4b0
SHA2560b64ebc3fc4697deb5d6545f53e787d6df9f231f7bbef829ae966d8646b07375
SHA5129c182c9d16bc2becfb436a0c4bc48f5ca84482d5693d6e7935a2afcc3825f2b20cb481aa8a5097c81f50f94c1ccdc56c8c384215dc6123dd99d4370ece90de60
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\45c38980-0e42-4318-9f11-befd7617a078\index-dir\the-real-index
Filesize72B
MD5da02bd56025733ed6dfec3e5424028c5
SHA192a1240bdc410e98877ac350151d8d005b7c7649
SHA256251f95207bf07f230470e5c4db72e7babe2a99e5d7ad1e7e476810f05126edc3
SHA51207ecf0968e926d5d711e320b0c962c603acca65c8e0cf99be4b662d8d2778288603ef7e1687432f7a6ba93dca2ede0f882b3ac7eadfc59dc28f343e5204b493d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\45c38980-0e42-4318-9f11-befd7617a078\index-dir\the-real-index
Filesize72B
MD556420b2be3865bbec0658ee02ff81628
SHA14581f8167868ddcdd3ed408322b3e18119819115
SHA2561c369dc39968f0e4977c169bdae4ac84f79cf14d37b7f8dddb6eca232343cec5
SHA5126a343e864ecd672591e18a4c16afd6001dda5a3be15410fc8cef73c8461d42b6d7c8ae7b2a8a02366505f2d1af6a533743d036ef450443dd2a3fd83d30d044e8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\45c38980-0e42-4318-9f11-befd7617a078\index-dir\the-real-index~RFe59aa30.TMP
Filesize48B
MD5f30e170d6d2c3e36d5fddffb1c51be28
SHA1539dd1f5489fd44d9cf1b087c2bd14cb50e2f68b
SHA25687cc990d422c28ef710199d48ee7cb10639eb29bed9fc6e4cd96cd2e7a738b71
SHA512f35a68de6f8eddfbf56688f2263bf7a23050c16395eab485c9d7b5e4500543f4e83532fba8212a063a20b65afaa74956692c38a64c8f9e1f8e9bd2904b261738
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\5ba780d2-f17b-4df9-8268-f40001524dd1\index-dir\the-real-index
Filesize4KB
MD5c13301952cb85cd425e1f4f457da06ce
SHA1e242f89e2606240b8b576124f8bc4039e65d9703
SHA25686f08f2ed9aaedaaa14ea4993f11359e5de3f6026e694f7294ab048345270163
SHA512a858a0222c4f952f2ad9b4335f38cf0c7704378d36767a9e1e82279004e6e66af53ed50c1d9e5262e01cb53fa16573cae95eb6256a7e9781a25e8e2c35ad94a6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\5ba780d2-f17b-4df9-8268-f40001524dd1\index-dir\the-real-index~RFe5a9e83.TMP
Filesize48B
MD5ba7d4ef647ed99945bcef1a4d4878a10
SHA118ee845d80bf14e8344e209d93536f560ca9436b
SHA256d3667addcb71937d21a34b15f5f5f9cfbe50135fcfeef7aac8ba59b3bfd48650
SHA51241ad57b6fcc00f33e951476cd33fe12e8d74509a804801208eee63747e36e46087ba549ce8c61ca9a5b7785355c3e6be46aaa4580851d50ff9f83d28eae4a62d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\024c5b230938dd30_0
Filesize1KB
MD51d9d05441d1c4e76261b1be628ce5ee0
SHA15e203144b43ba519c2394241f8049552f81f74a2
SHA2565d2a953537ed42f97021ce6434a9fdc025761d355d9421122ccacb2c199a603f
SHA512f93e8e17237b348394aecaddd5473ae7f4484a8b3a7d13f4d1f11c2d47baa0d977e37883133e14d65ec7239a7a9e3260e803c3f0ee7489154db2c849377a25ff
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\027bc97102aeeffc_0
Filesize1KB
MD5b51d5cad35dd8b40ee84c3202d45cfa3
SHA125d64f02aa52c88796f0a6cf31152cb2ecb01e1e
SHA256423e608d8390e454b7a6c792ce7da72db69964c5a43453c8fc09c38ce39824c9
SHA512f59e1256010a3824ba93ec69f1c3004534a93fed7586ad040882def41454a10355dea9965ccacd50c2ef79d91bf294b281a2220b1050129847e8d06dc0024e45
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\02c9882b241ab761_0
Filesize1KB
MD5e757f00a5167e9c2029331209de2e9c7
SHA16bcfecd06a088be7009ce8a2d25d87904b3913e8
SHA2564ebcc3d734bce20a0e43b41322615e2dc110fbacad02a461a2bde4bdcec766a1
SHA5127583b9bad6629850eb84da6b975ffa6243bcddeefa49ae4ca9dc2fe49dc80147410662d333e452c541d099eb773e1073cd6c3892719073d5066e2fdda4b0a43f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\0a6332cfab2af9d6_0
Filesize1KB
MD55b65b4be84f0947d70edbbbc29e80139
SHA186caafb930d227bcb9f8acf00a4c3d1e241d710f
SHA256710258a1649c7f3cc4e6be72be6a537bbf4d8ec3936cc7c3dab866b8c892c4f5
SHA51239cfd97cb2bb0469c8b3798bc2d7258ec1a17e4898823f383f2b098e87c1f81ea961ee2b494810a6d3d2af600ad93c43a0120ac8bfa0f78d2da6175415e0d470
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\0a6332cfab2af9d6_0
Filesize1KB
MD51f7a8199fea2a95d29f80f6d7cc632a0
SHA1cd128c34704890aab72ac72be864b2a79ab1e39d
SHA25654ce461be3488dcab0c0c270fe02ea7c9f18ff32103538783a771f7fc91434e6
SHA512ec200acc249d536f7c067f918a67520278962b9d7f6e7f6dd130f3f06e84353410495007657f619991ce85eb702f44bf69d4249040afaf37499dd3a1b034692d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\0a6332cfab2af9d6_0
Filesize1KB
MD5aa8e9cefd3b1aa0b47f382cc3503b29e
SHA16b32c51fc90a8b680b1cc4bb0b8c0eb14e8eb88b
SHA2565bcd8fb8d04fa8c30802af9b1a2f99c0f2aeb56518044add2b6584e1bba18a09
SHA512988996b8388108b991e1c391a8dfe0a451521ec968063f3e49fc8ad44993687768252f63c83571d108cb022bc8e715e14c293b797452f719c9ab319d1d508db4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\0bbf7f72ae590dfd_0
Filesize1KB
MD5751c5ffb5b8aa0e6afbfbc90ccaf8f73
SHA17e6b4207e90a96931d4a7645b17c1648eace9dca
SHA256bd20c98420a25194ad17d49c12efcb584c31f3db968263449ba2beeaab3e790c
SHA512b42ae17b06c1c103c9ea3643f414fea72e09f51d1b925ae949c7e0204a60382e5925c402a8b10b65a84c06728b4e484321eedd70fdddad473215b8a01efea369
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\13361cf1fb4c89b4_0
Filesize1KB
MD59e1482ee8bfa14f02da201833172bbc9
SHA1e900c07e81bba6b38fecfe63cc10b51dbee7440b
SHA25642420fd0f60de7a8ad08fb5ed134a658c1f1e4b0e3b1721d21de418bf3cc4e49
SHA5126cd199489ce1a08acb5b1dcff4ead495c9e9270bcbc538fdbb03827f9e62299bb74b578a4c0ae2263373af46bf0bbf71b42476417181f94c2a5a9db25bb44411
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\1571fca130e5c453_0
Filesize1KB
MD534e178520cd99be17ed3c71cd915b525
SHA1458e6dec6a1a5614d62720a138e71c9c274159d0
SHA2566f387832901db21268150fc308de94c3ce58fff8143d381643a6a647911bf098
SHA512429ec70ce24657b31e8be4b5530934c96e9cf20c2f5c17a9e625ed8703071daf8ab75c2666c348aedb19bcfa290326cbabcf08d8b75e93e2026dbe215240e444
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\164fde6a872a0847_0
Filesize201KB
MD515b21662c34b12c52177f37aabf54565
SHA1b96281b81c4861a7e808949e7b38bc0484963be8
SHA256f2abc8733f0d4fb4a23d0f46219bb25a0e1775e97a64a055e2c7b14829e03aeb
SHA512790348a12ede1522573ec63a544651341405df5e47f63176e786048efe711d546f787f661d0b2b290aef936561b7093cfd3cf941bfb5eeeee75fe17ac5dda17e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\1c527d03ed582a4d_0
Filesize1KB
MD533aadfe08041a4088db348e688040018
SHA16b41021d8a4e9669144cad54022635154052184c
SHA256afea8cc12d7a2ecd6754c51e88270958f40d93ba78bf19f10fceedf81c431803
SHA5120d9d15c5c60c1adbf051761952fb73d45c53b78bbf0ad5c63c507df3efc294914797146a1f541752e7079edd0f89a6c07e72f75b8562c9d50a069ff0d079d61c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\1c934b24ef196009_0
Filesize222KB
MD542651e803cb5d38c0b23153d76571dde
SHA1b93830d8585e4cb8cea2e2928f9341eabdf8c94b
SHA256f03513391fb08c6624ce0f3241565f2885ea8b7bce425996e87375977c11c705
SHA5128f7c1f81f2445a1359ba931717ae8e6b82bc956e36168a662622b2ab4a02e53d1f249d5af0c096cbd559e205287a37676492039269832029601c876a50e5cdbd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\23d6e3f05acc89b6_0
Filesize1KB
MD5502665b99a50b51a41d5480e88062ca3
SHA1699f2caf9e661c088ea0509afc6adfdbd038cafa
SHA256a4688cb5092797ddc161d5fead33ecabc589b26552bbc09e43810693c9bc0313
SHA512334bcf24decec5805891905164293a0879f1f64b502650e01d675d4d02779c11fdc0958d7cf37acdfb166e71599a5d4b92ea9e0834d2d36d8071a3b2cf1cb3df
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\2471e0dd7be7f3a3_0
Filesize4KB
MD5fef08165c74409e8113768b70b6c0cdb
SHA18b8cdcdfe16a668d483e2559e8e1286ed495247f
SHA256a53a9f614ef9de520a0c9579fab6e9f8212cbab4673c4077e767d644741877e4
SHA512f6d02b83f5290243568cf7b3e95ff0011fa3622e3b2feeda3f10f0dd40f00c65f879aaf339eaed3dfe0539eaac5c783b2a11e28d372d6ae32b8d47eb2368c373
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\28dececaa4444de5_0
Filesize1KB
MD5ac4f444545d90a61d34ef3a2f0587d62
SHA1e16564727fa8cef5c85410a43405a848451e5eee
SHA256341245979038cacecb1cfd81beba516478a26ddf45a34e4c3322e79b1138cb78
SHA5124faa90cad5b86258edeae2e2b26c0b293054d359fd42b414d3ecd9ced46cc0eaa85e81dd7e0ace4afc7e2a514343b6f10f12b2890014e2e0a735cbb559015f9a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\2c5a273fb0d50c71_0
Filesize1KB
MD53201409ad95ac98c2a432ac3ee6b344e
SHA1e8571e76a1cb5d89466a19157977429e9fa87adb
SHA256475c85a0904bdea7c75ace6533c4c3a64684575b5067f97df796caf57c57cafb
SHA5125ba5822d628543b88844918c28afd0141a39c10419104ec447715a6d0c9c8dcb12b62479928cb99fec04a93f9df45174463d7ab2ab3088898b4c95f130197463
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\39483a9c704e40d5_0
Filesize32KB
MD5237944919a39c3ff2e135bfff42d1087
SHA1b351cca713ea650feafeca6596647935eb222b40
SHA256a4f8f2d4eca1f98b16bf0d8301ac904fe7cf347c83d0f225150b2dee51e40ca5
SHA512d17f88a3d02656f1fb876f4d593f199af98adacc891b5b03f3383b71c6c993de416d4a5b6f9e4962b986a8cc1cb0a789cfe8d66fe98f9f816ed87799a0dd83ff
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\3ef485c132c2c6ba_0
Filesize1KB
MD569bf49e3a94a1dc219dc239e60dfd8ce
SHA1c07123cb22aa912c7d0448f4ddd5e276384b21cd
SHA25669693a8927f4a2931c446da5aabfd04043771c06d573644c5bc7651a3d46f7a3
SHA51239874fb0c7e87c20a0f8a109153035215b7f0aa74e0172f6a40dbbfde33d23e16ee2c5168786ad504666ebeb3d405384c4b1dea7fbfdc4c081848f3f142a6e6c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\3f8e74a044182478_0
Filesize1KB
MD5f16cb0291555993b59358fd1847c1acc
SHA147b6b14bdbd662a1dc3e896d3cfc9cb7fd8aedfd
SHA2565ae91337541edcc3074e1d58fe4b430d0c66f05801cc91c5926d2cbf11291bf7
SHA512afc897eadc3dcf250cf13aa8b836eeba97e4e8df7611eebc0387562a09c65ebe4192b3484b4e690ebc97d27cf2936897c763ea538ea8a3c59eaebe1a506c0a6c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\4162606168212115_0
Filesize2KB
MD54dfb370d4eeb7eeef6b39ba8839d65c5
SHA12cf54a869d941d6a924fc5759faaa81c8c43951a
SHA2568ce19e6a8d57d9d82ab4997995716255ad4daee41aeed6c9fc7a292a6667f9b8
SHA51226f12961aede8de6e726b37476735b7d6459e7cac137743534488e3d5ae1445f1c1f9c087b0a0f35d2af71faa376422839f30d03843ef6235d8490e923cdd0a5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\45080edd0fb77bd6_0
Filesize1KB
MD565c047bfdd5799562d15e285df305842
SHA1e6fce7245f556dada0117676bfe84f99fb5c2a36
SHA256c209235d984fcac32232ac221c61d0f9f7b68116b567587da58baddb6e102d46
SHA5128cd19c5cecbbfb2911041ffdeaea70952257ba091f1ca83f1648c19e92894552950876f7b2180e40449c59e18bdc714ebb8c9f4d54d9b5ed7af3c033064007ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\4a45de135d7fd6f9_0
Filesize3KB
MD5b98cc849aefc23ae1011d6ded3337d01
SHA18ffdb4c59a97015be7e80ed97b41f8c592f27b31
SHA2563a697911822039c1d322b2aa08ab7656bd9299d846ae451d5cfa4a14eec48fea
SHA51239a3aba76776f17867d1846aae6fb39d59ecf1683befe6ed83a92eb56cc8361be6d816c09041edb84040a39bf60330d5eb165910104c7bfe2cf86e62d5576fbe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\4bd24bf8f124d818_0
Filesize1KB
MD53e49b93c4f550e11cb9e8e8673a85a26
SHA16765f383ccd0341ced6a9a1da77a5f1cbb56ca04
SHA2562b6706ad55ad9c1751c201498f38a0d510b58ce1c8bdda61c647c25dd85e4331
SHA51202615116a301380c142e97ca934a29b2335e191ea8476a439594cdd42c2ee3fedd30ab313f0500f00b20ed8cb873e3531da0f8e89b01f34ac8d27234da533a2f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\4c1a0e4cafe94ea3_0
Filesize1KB
MD56a17e6e482c162f91e75346e87323188
SHA17ec3dbe42f832b2e2e0cb631495b02aabeeb6e62
SHA256598775c160ab5133b0820a194df03c9e0623185128527570ff87155f24f3052c
SHA51241d2684c6fc659f13a5c6cae57cd8996b9ca9bf457e24213ee266cf2143a558c7c0394635d36956b1f311db108709f4cee41d00fb41e6ebe0126197e468d718e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\4d92c2576f922311_0
Filesize1KB
MD50874bcb2f223db84152739171e1d71d6
SHA1f43854c39a4200dfce6d953a35dc66049bd5de0c
SHA256eddc69b6e7acbb539801be72bcd6c6dd3e90dbebd437c675b2df96cf739fe1d7
SHA512ae3df9cdbcf94539b1cbd980a0b50418a80fb959cd6f5ac605411d41161f53fd49b316a6ede5bbe440e8c14cc81a2a87deb269cf1e5cc2fae56bb8c2c1c38ddb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\5019503972afacb7_0
Filesize1KB
MD575d022d2a4e28498c70a742f23f3af67
SHA1aef734e5e4a2714b64ef3bbbe9b33de3dabe802f
SHA256da3745c442abcf53d35e9bb7891baf289b9a5c0d4860e1dcc63582e3209fcbfb
SHA512996301e370b495cd7abffbc6eb7d76db12ad1661296d67c141a2ab407528acb54201fc6715585efbe3f834b7fe081cd7810b9b5fae63f261b07f3dc55b76869c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\50aaab61a82b49e1_0
Filesize2KB
MD50c0aa624f43c03d5c3c4054b970638b1
SHA1d6dccb19208a49769c7aa64e9122b7c409a03ade
SHA256f2fa46491309a6f0595684a90814556b189512b71f81df7ae8e9f6a46aa35745
SHA512cf226ca10c1fa0470206960a0c1a3062d2874059fe4a08a7432305d747086334270a7b348f41dd389ba1c5261f74a853e93887d47408c967838632acee7c4881
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\53447a5607f3eef8_0
Filesize3KB
MD5183d9dffe1f13a1324d6c285a02ede01
SHA1a6015119a2884cf6b42c03bdc2d25d81b6df6c5c
SHA2560b7ade7f8d4ef0caaa036fb61cd8be8e8d34ae48796064ad387aa0a208ab737e
SHA51292bb9fce7353a735c9ef3a43480267d916941ef428bf368e6e3a64b4c7df5257ba62f4982e19f605cf5d90457d1c4e5fd468b8a282b47dba50f7f11b2e83cbda
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\53447a5607f3eef8_0
Filesize3KB
MD57d85447dcf92b9f6dc852b5e6245140b
SHA15a02a84cd529a06682cac159de8d646b5c0dea31
SHA2564b9ded5987a078a9590015b3ddbe37988860064500cca14c75f7f324b8c0512b
SHA512009767ff82713a89cd5082238ad9efb6a1b0223d1b9aea055af0cda41d866413716970f5648f6bfbe76d478c7f0a7b8513debee949439b3764951b251af4441e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\5d2fa3c811d471e3_0
Filesize2KB
MD51816b18abf9e60344b6357255276c0e4
SHA1fcd86b9d485aeb38d29b5e3597cd5920611266fd
SHA256e7cf2ad41ab6ca9c54bd6cb764304b2cd071a08dbb7f958a889a9dd514e5db34
SHA512a1abcdb79831014f1ce14f9392ba3add1df5a776709df95490caf0e4c624a39c92a4896ad89657e06789c13a553002ce03609e2d00bff443ecc0acae7d15b854
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\6751034b5dcdec0c_0
Filesize1KB
MD538d0af559b78b579b057709ff697987e
SHA10235598984a7ac88e6fd61c53b191de59cd3a3cf
SHA256c623ce5ccc2a3aa6f800ad7ab01f5e25e0a713de22226b31b98a35ef83dab8a4
SHA512a923916a6f5828465f2c0eac49838c946091e4492b4cc51e8b13a0d19717624476b9de10d2ac705191cbbd8cc34af3be0cac1a563bbefa1392cc11b1b32840e8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\689bc6a30eaebd94_0
Filesize1KB
MD5eafa2c849d7ca69ad6f3ba0e247da14b
SHA195ff73af9eb0ad62a9c99f35b8c011b23e963a8d
SHA2569983ff83caf71d22072ef3ff78477e171ee69d4cc585ebd52eea926de641ae82
SHA51217637ae88764395cc20bc929c4d4835c16d278076d86931a2c19d71129dd69b133a0efd2e55b41232cdfec068f2385717d1010edc3c23b9e2cad4fe587425fa0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\689bc6a30eaebd94_0
Filesize1KB
MD57bd17187d7d6c4f75231c0abf4ea2d0f
SHA1bbf3d7e041d70af511d5a403e72863e4436a7505
SHA25605cfd957ce9065ca20829a9c5e422748482f542092105f60d7d8616310e23655
SHA512ed4a69de6634312b6f4321eb725f8808d4c77de437be337cc9f0a34ac774c22ec0055da36b66b00ab6821982227f3703d2ba55aa525fcda85259784915f27ae5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\6be79ec498282693_0
Filesize1KB
MD55cd484104092e0877f4c57b706fb2287
SHA12645097a2fa948865c85e4aec0898453db606d93
SHA256aadb8bffa4557d8a965e5d103ed674542ef31b9d1e0a7c2a86de554100692129
SHA51202fd580b8fedd654ff7f74e4f04cfe9b33e5d8cb96d127a8399c0303264fc1889e8be1f271d53dedb5bed31bf93745524d645bf8de79c68e9a0035c0a4a6d59d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\706f72d34d38ca2c_0
Filesize1KB
MD5774237cfeac21161df18d59febe5df45
SHA1524411827f36b2d2d2c39dc88d93611c3e46fedc
SHA25626ff62d3877c6c953f704d928401c08729b1666a0cd575a095fb9d4cab922bc2
SHA5121fc60464899a3533c59739297f0557570132083cf0cbf1ab956f24951e0ada6d277b24bd13661ecf5063b4e1d9d1b5ef2e8187b269f3d18f259d3253e18f596c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\722f1a0f37053e00_0
Filesize1KB
MD5a131b972e3c52d4002b792bec4659786
SHA19bae4931c8bf79b400ee91add64f531b99a3045f
SHA256dcfacf863c1458f78f1b952042eb902eb42ece51cc2fa50b358953144cf4f1eb
SHA51202f33c8fff91078e65f413e50cf8e70d80d1346bd414939493334838ca0451d5fa1e92d07e322be3e4cf809ee4d671af7f3dd37727ec45b508f4eb9c34ed1c7c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\7a0ae408f7632d57_0
Filesize1KB
MD54d81bc740e790cfcfaf430885045db68
SHA163f9ebdecd8aaf919d3da0517a55a5256757358d
SHA25647dea46fd612b9f126b36150afeec065821c3353985fbcf2468e484df0b4dca7
SHA5120e17b80cfb4a51bfdf30557ba3ef437578de1e2dd968ffe6829129e88a3c9c285f3891a7dce8e2d0093c5f44e0150db63f071a448fd7206c63cc9e873e6d2292
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\7c004eef6a635841_0
Filesize2KB
MD56c0872cc58b746054d80eb77c73ce931
SHA1f586af857c11ec01f4e19bc0340fd793f8c161c4
SHA256ae0f054ce89ed956780674197957247e64cfabe29f01ac7e9e81071fa74b6bd0
SHA5129f90f14416d6d277f78379a53f3c5e4b5141e50eb25edb0bb008dcc294352806d8ebba08317aa3d225b0b8a2e7cf0b455fa73bba3cc206fe64f9c8b95ba5260a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\7cd09e1bfbb46e2e_0
Filesize2KB
MD5d3879e0a3ee5a8c13e039f39fd0b323b
SHA1bf09da835b8d4a8a23d05a009bfb47ecbc8e539f
SHA256b0afaa8ea637be8eff552a4994b339c132c3bb0e175925c14413a611ac1eeeb8
SHA5122e949009b73baafd4b4c77bb90fbe0b25860147349e03a283f1d3b53ee5209ee75f38b3500c68ca213e8c3a08e13ba9ad9c24942c568bbb8137a7ee7ba8b0fad
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\83c09ebad20bd720_0
Filesize1KB
MD584fe3fbafb4c7d6ae322f87f4626e22e
SHA11bea30315c2c662b45ffd1ddfdfed6d363322127
SHA25641f90e18323d83430979ee01af4d19bee9b377b09f2cec282d19f716e5fcf0a3
SHA512f2448ea4f9a5a983c76654cccc73a88ab19647ff37d5f30888f73a84e30cc479b85ab18f64c0e0e2f08c0471acfc9ac2557a9a2d537ccfa48f647ac777cad1f6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\84520e006b036619_0
Filesize1KB
MD52064778e35c9aad902677447ae7a2627
SHA1fcb71968f16188a1b0ff31f28bb007f11253b574
SHA256a7e31f752d18f1bd491ed5b52a219a17175581bc75e91b9125d47a83283cf1bb
SHA512cdb78facfcbe83d59c72008daa78d457c84221e036b4768946db0927ba8fc5471caad07f8bf4cc2572e0cab38b4e2e3766f9dc3c3ebafb752cdadda5ed612627
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\8b137271aa750371_0
Filesize1KB
MD5b7556431612dba8da9447897019246cd
SHA1d4d27e5fa8637c57aa85d3ed2c6f19d0a23f06cd
SHA256d7ee50e7c30fea3e53d717a0902fa9f0d89c14e74e1a5ad3b366280c0fef4674
SHA512310a7aa1bff9aa0c712d9ce52d0f521604e73b90ab791b4de93281eaf337e4d8fbbcebf373800adb36c1a18b4db77432db7c065a3e562d00623883cebc924ae8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\8d0a364bb51ec794_0
Filesize535KB
MD5ab6ea97c11831d269c2a0610cf90359d
SHA1f0beffe1d78ba895c1743fb68dfabfecf4382eb9
SHA256f983658bb63e5dca0ae08d4d6f3d5434f5d449bae7ebcbe6dc221370fe7831d3
SHA51279881e970e3c154d4db53249a4e637889d7af41d25ab4aaa9b74b4c732c907ddd5456f5a0c868ef8fd235a4cd571eff6ec58b01b1544c4560bea6071fa90fc6c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\8f4dc898a675be2f_0
Filesize2KB
MD5a9122073413760c94f40e0bc6112be83
SHA176dc38ce2aafc18c10fc9517801a1dec7e66e5f6
SHA25632b0e7a44e73318081ba7622451e9957fcb5177ebe2bc52f80119a4444129079
SHA512860d6df4e1ea0426ae2aac05eb72090de9f35409698689f8e4246429f36eef2b8a86e99fe31a5c72ee7a680f5d7c1fe30f9ad7464c89d60d620e1053d8497d54
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\99a636088559e142_0
Filesize1KB
MD519c06d1d235610ed4823d21208f012b9
SHA1ce5b6e350e4f2012bfe5be419a83afd4f3df4093
SHA2565141c4b2125ad297f990a43cdf20e5c9ddf369ad5e9c9ad7f14cbf53499e8415
SHA512714d247a6f907b39887bb7f24f187540adbf2f242837304bdc077aa257c1d1a0084f74ecc0d602582da7944b672c2134a2ea963186d71339d9fea597833b2a27
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\9a70c06ffc359c66_0
Filesize1KB
MD5a4c17b1452f19689b798fe87bee7b6b4
SHA19508a88962e62925762914a53a2ddd0bdec51857
SHA25606fc589c1e730c088f2ad7393d02234c702fae80eb39e0701b460232d26844d9
SHA512210b7af63d32093f82ea18ff7514bffd2a08f1b8c799e1a3f895b74048b1fe5bb82c7cb87d02e26f172091369d1a0727ccee66ee804d8601990b86ac87a1d7b6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\9b392e5185139074_0
Filesize1KB
MD5b829048b8dc36d527725ac6cf4b9c4a4
SHA15d6ccc1348d96a09937db53c021d9f968ed37744
SHA256e730deb6d768deaaf776ada0fbe4aab2ef8e78a3ba7cd31ba1aa3402c897e01e
SHA512dc8241094286da79de60a71d0f25262e721f5c73d498a22627559eb5634c6c998234b87c15cdd89652f61cf5ab65a913a4e5081c714c35a37723448ed76b0e7c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\9fedd8ae307dbc4b_0
Filesize1KB
MD59b35f2475d593dc6fbe9e2b9e6ad742b
SHA1ac99412aa0956a0df0902ce59913d189e92ad615
SHA25611f417f5a56d246037f820a507d8c7036bd58ad3b28371e6059917a0a3d6a8dc
SHA51226d53be0c3b20e9ac59cf561541af805e4f3abe95a7f3390ece2ff774033da3c7fa335addd8ed80a60c4ec97fb0af836ba9ccba4d78de81a0e14f4cda9cfd739
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\a043001f13760623_0
Filesize1KB
MD544c3be15a0f3aafc28dd1fa3a1a1e6b6
SHA11ed561c25d231d4dd9c39f6749ad56444246414f
SHA256ee15b70009fb0e8466c2b65071401b0e3d5934d22bf0634c034cf6b3317c8266
SHA512ff78288808dff317eb25db6e6812871276ff6593eb357f35fd50c5eb69d184c530cefa4b7fec805b9b0344fefd9d100cb90901dcd53a0f8a27e97055bb5a1ac4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\a3a77ff2c7731dbe_0
Filesize1KB
MD5e0ff1a729057b54b0f5bf3903066f490
SHA15072f7de79c816c5a8e59b76f329109721f926f8
SHA256974b056baee53d70e2c369be88fff46f20bb7aa276666722d059a06ed00dce95
SHA512f661fd9f294c224de5b8c8ceac3b301e79ab6f9608d279f979e5adcf75b7b0ec44c5002146564fc7c6fe96b6b895e93641d494937871f44f4067e44efb5cc820
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\a4ff7a8f52206b7d_0
Filesize1KB
MD5eeb442db6eda7265cd40857233e9f3a3
SHA1a43d5d49f42e1e49c377480b62613fcad4a38ec0
SHA2567b044ce23e9db83c8066b903ac37e48825f5fa0f97186232cd72a04a711089b0
SHA512e1a7fd019491b6fa160fdf6721745d56f9746deb82098125a2b81f18ffb9e2bab288c57b859b709865a24bb53c70fc99350cd66fd60a689f2b34c31cbd12a3f4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\a56a39aedf8aa9f3_0
Filesize1KB
MD55cd453c6193d336b8204c274d8dbb42c
SHA12776f9c28814edb3c7504aab46d3a2848412f04f
SHA256002ad215c2386a4e5040c303b82c9fa3edabe6ebbb662d61c2ab61d9eea084c8
SHA512806f84de41553ba8a8e928c3e45631e07ffd4a3c32c92ff042e3160d4ac9bcc2664fd0c2fad403cbd9f74f25a9e2d5b0348a66de50edc2256f5126e59192b120
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\b624ec0e7e56f77b_0
Filesize1KB
MD57e41bf09e6732a39e1213203712159f5
SHA158113a3ffaa303821f0970b50351fcc5ab3f7324
SHA256d2bb68b95097885ee1f8262907e9b5f7ee48c49515f899a03e47cf5658f95581
SHA5125636aa98bb8f3e7afdbc55012bf74e3dde809071fa4e80f145663e12677eacfc8a8ceadcca412fe15b42d342b6ec89dfc5a2e1f3c46c5b856da5b6a138522fd7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\bc233737d879048a_0
Filesize1KB
MD589764ee92fd2e585c3beb895627ba036
SHA1a8d1c9f974ff304e56d95035f10e16f8b0508f07
SHA256b6b4e5f9d6582a05c4f6785f066f93856c63651c723a7aa859a33d3dec71f8aa
SHA512c33c4a241aff851394b6a2678caf6a7515fb4885b45a70cea14141b77bc695fa38b526afb2316dc13867d033392815a58b7a667dd8a2325025fb6f706d1a45aa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\bf343e1e46546353_0
Filesize1KB
MD5c25911ae4ecef5d3de0eabaac9b75eaf
SHA155589240b0cc70f6d3c43fbec5b83e5d129c292e
SHA2568e26fa39183d26163ee73ac625679d9367377e3bd1f9868cf9b8b9195a3f6247
SHA5126e0f748da2733f365fd3f4d05c9df36864f14586b9d8417043f4897b366e2b1701780ef936509cceed18443aa540d1b5e67f8afea0bbd385aae1145d9e4c7bf9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\bf343e1e46546353_0
Filesize1KB
MD5af380c3ac847cacd349eb2f4726b1aa0
SHA13b83f5ef4ac9855c97d99a9258f8ce8438c8e3cb
SHA25662a1c6957a84baf81fcdf1657dd6a9f74f005ec83f3f71de574123e2b8ff5f5c
SHA512d3468a88845c62878b785e9c094349f38a5ce5c79a158cdc6c5bce76c8acfe6dd8ff9a83d2c95e942633cbb627fd7d102047143ceb9124a7f48e328d0492759d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\c244d2c53b0ba969_0
Filesize1KB
MD57b37b0dee78a431b8b02e9ce26e44316
SHA1f16de233d696854122050e0cde288644baf261c6
SHA256dff24bf100b0ba0509d23f2456cafd5bc4005af27e8b4b2b35ade45b9f7831f6
SHA5124012acb1ebcd93b07a4ea19297145809b28f79a30870baa54be3d7412fdcda2e45cec709f9f0bc8391aa28746fe6e9aac3fa07ed05da591695fe7da5090e1dfb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\c3174d6a1802961f_0
Filesize1KB
MD5a35a9b15fe86ddba422815c8abc18135
SHA170d1b33ac4262fef9db3aa7e24568ea812523744
SHA256757daaa6eaa5f9bf79b6fc366f1d64893af73c193cb7b25ad494d60c03ec1501
SHA512dcd676b94b85e0ebf7037862091752d5f78e1617f99bfef8901fad9d39b6a7cbf7d6b7b8d6dd617302dae37f6518b6d708ad87efd0d5a761fd13d95b8eda5cab
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\cf049bdfb02802ee_0
Filesize1KB
MD540b982aa1907999ee6c105f4994db70b
SHA1cb9f4c557dfbb65e411a9a45abd276e1026de62c
SHA25697dc3cf2fc72e1944c0bce3ec761c57271981f24a1fd745990e3d5b4daab0bee
SHA512f2223f2d0dc6fcb74c8540344815affe5c2b4b434b0aaa0acb7abecc5328d85891493bcd1699d630a33c073d2bb1cdf2dcd591f2af23f63fdf5ed25ccb75dc52
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\d1ccf8aede3940ed_0
Filesize1KB
MD5a4f51bce1eb1bfe18ce8756546e57e16
SHA1a41d8bfdcf23d97933b81360f8eea60772dea039
SHA256e4355307e18e2abdb8bf5dcae5a225dbc91a87f7e3239ad89fff7d63092150b8
SHA51225d7ea42c4dffe14c3a1597b7831e89ceb8a17283e2e6947506ff88abb7e42f4286d95972c586600e1e353f2a909104c5367d7e95b77996432119251e85d179c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\d38c64270b78111c_0
Filesize1KB
MD50944bbbe51fc96e1f28b6309284909ab
SHA1e384e42ca20d1dd02e1428ebb065d0589ff92f7c
SHA2563204ecf163082f85b15e847094382d6368e74aeee0b1b7091da716845c97c12b
SHA5126139206169460a88190ea496ac15f5a3a2d2cb903b354df821cffeade1ead383daae6cc796e7d7a71a7cd21d51dc465b8ce8f9943d9c38c4ea6c8908c172e813
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\dab7549869fb3e12_0
Filesize1KB
MD5c338ffa76d73f0aab8aa648ced677493
SHA1db9a70ec48782645b69e845ac0dfe6d110d73457
SHA256af5e03fc31bad72488c340da3baca130de02f6cd15c104e23e37777db9c1327b
SHA5129aca5e51b315ad41ce8113135693d8e9e4b345d72b25f3fd8986d1c0c43ba04060e7a23cce790f5e708e186090f0d5d13631ec44d48f8cf5fcfa9463dc741714
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\dfd57c61ce10f211_0
Filesize1KB
MD50edcfbb1a3e2237371d6509004231f78
SHA1c37a2de9757ef9a87bdf2216a2db8e00a42af401
SHA2562ad6aafed86b305c543a09fe573b2e6cc2b4e3fbd8eb303fca0167c26c9f7a33
SHA5122dfea3f50e1cfb9e843ff2b4c37c65c73de0ad2f66deb12aa145ae398f2cdbd2d6956b2deea4aeb70dda87b1d974b5b22f28c1e889b411a4e8597fd3ccd195e3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\e25735c81b54765d_0
Filesize1KB
MD519a94659a2dd7108d6ffa5259f91b577
SHA163fa7091cb1367826b73d88e326772989070bd27
SHA256287e75707ed0caf645d99144210aa5db136a40d71d7e0b2d1bcc08758cba23b9
SHA512150322dd8b0bef1a46fad625e7e22afeac88a7c713e9aabcd794eda3b708792cf71b039ef2029b9812db0e7cdbbdd0014fc6ba4ee2e5b3c895e311be7adb6a43
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\e25735c81b54765d_0
Filesize1KB
MD55143fbffcb4a76f9f24b50de7d494828
SHA1c1313e675ff0718e39d572786427ac986e590e13
SHA2565bb466a4c3745dea8c1cb66a8a28b52d8b2d08882f97bc92d4db517e06d165f3
SHA5125c88977b00743fbf773bf6cc87a7fa0f5ad223e2a9f0982c6422b970c533f058546bbebdf8987ac5462dc8e0368afc79af145697b10b21230a0d9664abafb5aa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\e25735c81b54765d_0
Filesize1KB
MD59d16507359e9e826ada877300a322b51
SHA1944a6552211ec9a271521b9e44eca89057d72d1e
SHA2564d02fa08e3425fa14122ea0eaeeee9265c3c91f8e22265087613d15244ff77ff
SHA5120caa6e4c1b17397914770620709c4a2595632cf4bfae9f165136459b3425196c01e676577cb651f5b12f3933c073e3d138f0fd22cdf04a7212e86fab660aed64
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\ef60e400ac744198_0
Filesize1KB
MD5f16548b5663f12112943d158a46acdec
SHA1d9161b925fcdb599e83b62f59e65d026a8c50ce8
SHA2566b73292030eedaa8cccd585177168d1cd11196318a68b32f5bbc1e83d266acbd
SHA512f7df9ad7587c2bd59576fb0fc299cc8efbb95d5067a32f5d56a4df870bcd24a4e7dc2408f473bae2169ce3072e53658acfc8dcbc6d0ff0d5bb96e334580dfe34
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\fdadf9ca22a2a02f_0
Filesize4KB
MD54f2fa6394803cf4c2592db175b33f89b
SHA1ede14800bcac2c6d141ad42ffcd9d83e36830add
SHA2567cc36f6a56070d6299009dbb07cc8528ca9bc6ff35f6433411283461067aed83
SHA512884022fc9ffb7b1cbeadc925d4478c8a55961e5a2c73d3de0b80284bb6b1fa74d9cbcdc1589184ae28ac1000351f4aa18d262f7183e85ab5392dea4c30c50d9a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\index-dir\the-real-index
Filesize264B
MD5ad424fa01ef3598521b334bc0a1a4572
SHA190f6b3dbe2965955239f89a339503f92899cab46
SHA256a491cdb990e477cb0d0266c254684a90f92bb0ad784978d38708a0f9a523a0a2
SHA512f863e97499d0685e8b8b1639de60a58456832f5836a0e734eaa21e50b11eb25d75a9969dd443f16e4c0f0b8a87351479fdc5526c0d7c514c3d5ee084bdd13fda
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\index-dir\the-real-index
Filesize816B
MD5a9b4a965ea03c607243258210c19f1dc
SHA14e4a0a342854353e0a052aa296c02f116ac878f8
SHA256a8d1bbfd9109b73a783106b32c4225096a4ac4ad2f6d0069e55f62eaddcfcc35
SHA512d66d2de540f3d66981da565b08e078a8a0b3b1b8246aea5ceb62970b33d20c6edc0c9bfd62b5d8074973156a5fd3b65745c87d55fbe7eb970a34c70c0f8bffcb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\8d635122-4e39-4289-a75e-a3f51395cff5\index-dir\the-real-index~RFe5bca51.TMP
Filesize48B
MD53354dd35c0226fd4f2207ccee08e3c4f
SHA17a6975e7c6669152465d3125a8dbc75ceff7b744
SHA2568d55b3ec1bcd5280e59944cc823c9036059dbb5f6cebc3ef01f804fdf620eb19
SHA512fc274709b3887b1142219167a22c436264efa422b66258dfb7dd6055e66fd722daeacb9c4c4905fee9a5b4dbd03427f417c4d5989ccf6381cb35a9a5d2165db2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\index.txt
Filesize85B
MD52defb7c13056e6a25fa81d32624889a6
SHA1f89af02825ef8808a2f904f599ea120ee76cf370
SHA2566b0372f92c5bb22087cecb8dbbbbff4a87dee50ee0311c6b16cf4256dfcb2bf8
SHA51252453fdcc7e779f62756ade481d1b58c4d2c92d662d5320bcbb84de3ba12a96908569c585d6836a20dc68e0a917e140dae1ca54a2ebecf73e239081dc20ee50e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\index.txt
Filesize233B
MD579fcbe8b009fd659d5a7630c2875e9be
SHA179a5f7f2e118a818348f626a45f84a7619a936c4
SHA256b7b5d4125be772d81013fd4ee6225e3a7bb09bf2cd29c0d2eeb608c9ce7a5e07
SHA51203bf4be39ef902dc03da2c3d92d34aabdf3ccd05878b772e0a5ed699b5f7d449e71fdc00de080bcc8194a36954ba5942345ce5ce9357997119731d7b536341a0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\index.txt
Filesize289B
MD5ce298d4040786d54321816b609991778
SHA192a5a7b9e659668379accc4b78d7bb7553201246
SHA256947944e885ce54655569e5a4cd694630398a6a633bf2c7b2f272c1813238c35c
SHA5121417abec010291b150b8187ba89b26e13840205a9884d2c156d7050bb902846bed35b85c1419fd89c256e8bf6edbb351289cde226505cd62422c265acfff904a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\index.txt
Filesize229B
MD5f51cb0f4ee617d6246cacf33c991e822
SHA15702302febd5269678da6acbdbc2f452eceef0fe
SHA2560af1cfe03426af9050251960648d09ddf738c17fc8e1f35d25b30dfd92e36ebc
SHA5124e72774616686eb8e978970fb9db998b167e9a08fcc072660c3a5f2d1abe567d598ee2b029c3763627c10e5b63aee0e243f996b8b92e59d6175bcebed0f25c21
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\index.txt
Filesize352B
MD54569ff1e33ec47aad374b148ebeb92cb
SHA1bcc378fe685f4044bc9f77e23bceeea5e8b27086
SHA25652a34c81afcac405b92dea9494ab3e67b7f065c3fdb473feb3e7ade9bc5c4bba
SHA5124f1c0037756b8efcc751985c1aab6050bbdc40b053aa1998f71e427476d6745201df2f7df6722a0f13aafb8c174bf93c420370e951e858c8691a9a2161d55f11
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\index.txt
Filesize353B
MD5f1c729a327e4be941134440c83a3dd41
SHA1564b93b8378afcbb93fc598e5f73a8034f421e7f
SHA256235ac55de1903333af96275d1c7826ffb73153097aab453ed33daee0fc4d06ab
SHA512c9516d20696bed479e7b538ab19cf87c6473c50a37a35c778b91f0fd74fe08863176b83c29aed0d0743fa094349621dedb6d4e98db37e8201a07ca3cb5f7c3a1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\index.txt
Filesize173B
MD5e45647afc704eefa336710d17474a424
SHA1e38cd7c8a72b5458beb5c7495fcf23c2e7e79291
SHA256ec062f7891e2edb0be6403520ddcb412fc85484fd5029bb20eb751024a82e1f5
SHA512ee42d03de2e4b86f8df42a45e72830a424f98e4670365fa959b21eedce3d87537f8fb0f16004977a082e1333b7f74bf9e339fd11b27b914afd18cc7e5dd27af9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b1c9aff7bebfa2d91838202bb2abb94f0fffd8d8\index.txt
Filesize351B
MD5ec426eb5f255261acd31bbbea6be085c
SHA1e4bdddc94374655ec76b2a6014b29d7f6a6272da
SHA256637199815af6378775cd4c1aebf28f75dcdd46a1227c5135b6cfdb6bf98e7f49
SHA5129f11e4343d41ee2ffda7abacc1faf3d04eaa5ecb008cd1bc2f73f6b8c7a9e76725264f876ed13b4f76baa87be959f288b8d24c2c17274aa434cd0e812d0fd4c0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD5a0f103d86980357014f314f781da3927
SHA148d11d524533ea35eaafc5c0e426a297a75a36cb
SHA256c4d29ffa37567cfba2126357782f3899c734cc2e98284bd9764e689b1e9d2731
SHA512d58669a2a2e08b8ba6bcf0fc18c76fe7ed9138e16211470e5d6ac2a888bbe72f7f589b821f1b7c0d1c6ba9748450e87ad87781466b9afc258c24f7664ca9e7ee
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize120B
MD5c5f2f1e8d1f5e773de4089091a5b9bda
SHA19fe7fb0293a9049a86fc93351aa01a53a2aa6129
SHA2563d16872b576a180850797def47e72a0776eab50919bcc4fcc0241d7bb8fcfcc9
SHA5123f2302fd683242537813af154c7cf2b3f8fdf66dc927f356c511b782d7e4251442da6610671d7ce7d4ab33e76cddc7196c5b435c0ce9e1e5ff8e0993295d3bc6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe581846.TMP
Filesize48B
MD502fe4b3293f7a491c3b05f2c522a74c2
SHA109b0d3514580ee0f94d4b5d18cd6054328f973e5
SHA256024046283bf031ed2861500a2a32cde11840fc17f844aeb3fee0d8d5122d8cde
SHA512ee83e197ccecdd5db4cab7091f140e01783c5b19325c486de360af5c0b62eaf95259840ddae7af6eee152bac1ca1f52f8df54a3359ae38ae081cecb65ecc9bd3
-
Filesize
1KB
MD5f2bc33636aae22258878d3b3e2cf7ed5
SHA1c9ee876e8bac7c8906bf56dc07c463fb57a3694d
SHA2565daff846f43f51d85d8a5ecbf0f4d566dea07b3ffcc9f18b9e4eb95aee2370cf
SHA51289eda2101c9e2e853123f1008175dae578b9635e34537dc64afde7b722546fa208e7eb6093a77760fd3a841c00d06ff580f5f39f3979cb519ee7520dc4923bd1
-
Filesize
1KB
MD59891dc4f60d59f5c7c01860e3d2d1782
SHA1f8fb080c178b391d07b85d6ce0dfb11d406274e1
SHA256026ee8fe442122b3e0d6ed7efac158db22de90af4a27481e9efa7eaf3daf8abf
SHA512369c961863715b10b488fca71d8e2b06616db3892621b37809ad1f3b2149cc50570cd2bc44f582ed870f05a67d83c016c66075febd483689b91422f0dd8e1a49
-
Filesize
1KB
MD597cbfb223e80f9dfcbde2cd3d4808078
SHA1b2e6e013c74f7679f552933ea9e16cfd58c90f00
SHA2567a8b304b39e564e0ea79a3b4eb16156f66ed01994575873c70bfffa6cff3c518
SHA5121105e4252664f261195f2dd6de6438d9babec9b3ad30b94caae983cfb0884e3898cad120a9c8348d42b49f9f7217ab882504e498d271f103c4588f4310e8567c
-
Filesize
2KB
MD55e150c364349224c24439e782b2dd478
SHA1c8b9b535a3c7c55cfff6402da2f59d4269407e4a
SHA2566d235284f4e1f978c9de5fc4eea409c5ef871b3febe7158d448b81d7fada47df
SHA5127f841582d38994f25ea6a8b3c3b051118f60e85443cca69b539b4db40fd86b08b7516c239b425840ec7d190ab56a24077cd6e172c8ea9fc1fda95639d428d812
-
Filesize
6KB
MD5cbacb211e4f416591d94683ba54e1127
SHA1a565bae27be6e8bf599b913def6f7269cc37a9c4
SHA25673aabd5728f68b0bc94a118b515e89d5dc03659a7b7f96a60a50457bd5fd5427
SHA512f87a57191b3414ff85eb868a776c072ab01b6f3aaf88ce6ceaa12eeeb3d864367f5f7771e7beb213bd52c55fab21a8cfff5c8f06dc4e7d3ecfab4e0609960963
-
Filesize
6KB
MD555fb4858823821c5deba10412906495f
SHA166bca267048c64baedbb666746a023bf781389e7
SHA256354778a55f4654c2a4b4a4fd5a6b1d23884dc066ed63ccc872967b8eb0a4faf6
SHA5120c8e24e9e8bea965f00f041167d538d9476ca05befbad89942841b2ef2ee7508973b461fa91cca8210d2628df031cb83805c4ca068c214fd7d4beff1b31cda8a
-
Filesize
6KB
MD56927f0f71ec2be78a6fa2540575323e3
SHA1e7c6622fb0db91112089ccdbd0cf592645885c50
SHA256f36e0059a06c0227e2bc9e3a614cb630a7f0413a530cf2faf709827b426fc727
SHA51276df29856462d1c4724d4d9aab18603781f0e7622dad0ad74f8635612569b3ef9f73d5330aeca8564905e7ea1faa7a7e4a89f0f42eb9112d352df8fb8ce19f9b
-
Filesize
6KB
MD5f552405880f102b85181c182ada2aa1a
SHA17535990500ace329fe209aad0c63049b3f654efc
SHA256a37e881dcbe832cc6b52429c78cec71d482a729a17a484f7fdf25a847adece1f
SHA51248791fbb675a718ebc8086949ddecaeb014f1ecd52e5b6e7fc2d8a05f13c1b68f3d70b5cf068bcd5d842a71824f3d7564616a120554e74e7eeab9c7e777c6e9b
-
Filesize
1KB
MD54f718556468861d04de5021c2a9157ca
SHA107e27d5aaf5e7d3e6c513f5c3cc9f6cea4010b0a
SHA256f391633dfe0a94aea0ca5b3be95ae3a7523b882b4ee4b50116c4551f7f5db86e
SHA5123bfde8b8fb97641dae3d97b9ce691720d4c3348d9c6fa713a41bd27c1bd9d7d70e6d33a27bfba46b85c9bcbac8943828ad40db2b866b5496660dc791c9631410
-
Filesize
1KB
MD5df0b4b101e3958f481503d2c183120ed
SHA140d6a239ca5b940695b316e64955e437b60e5867
SHA2565de543fa6c6d12d01d56868c6adca4a8e53762dd46270868c6cd5426eead1abf
SHA512e43805354d573238a711e62e839f1ef85562ffe4548ab0cc421b5b3ee95b3bdd8c417f281cf62cc3791d96e6ca6c01efd7ce8b931a7ea9bbeb86d9764c9e542b
-
Filesize
1KB
MD54f38f094e2d4fe3800fb2607fab76a48
SHA1776af890d8881fa6d1f9be3364a8f1895a66d78a
SHA256c94d17e8b3c91e31c31cdc96a574bf132ae3ec12f26d4def215158218332cb87
SHA512da969a60b828deddfe7a5f7396b243970598e7b671150ed1052e9689ec0bff0af808ecb522b0c2a20c3fc39bd22d98fbcb81fdf479dd710ab6b1535da2ded241
-
Filesize
1KB
MD537dde330f97332f3001daa3c253bb5bb
SHA1ebe539de0fb644e250fa0926b0da803cffc0812d
SHA256bb7d8d2ef24e4bc5ec8f5aecfd7e78e10660cdc8a8fb8e43bcfc8fdbc4a4ac50
SHA512655033ff37dbdc97978d312b22e4c3fc6192be019eb24b1486afb34a58f326bc8836be093b91a88d8e532ac65cf12a1d65092c2e1746621d2ed98cef30011518
-
Filesize
1KB
MD53eb6eca1241f699a530e811853526956
SHA13204598cc185694ea8204364cc8fedc6be867f40
SHA256a5ec9811e6b0d1c62b075fbae8d7c8d322e2ef7eab659cb3acd028408a9e46e7
SHA512e1f9bc9ad54d0f55ae9e25094f5ed633f47dca3a74b21dad83eaf145f96fa88bf1e32a9ca9403f1101b50f137bb632a005615b9aca759930e0235aab5abaf3fb
-
Filesize
1KB
MD56eeb0524c57580016237accb467c9351
SHA1f676a04a26d1d661d6e17a1b9fd27c56c2cc8e15
SHA25651282fed2111d888e75d1ad9f71ed44d97de1d456005c1bc4d678002bbd6b435
SHA512118612097c543db2a24d7a86a22cc541c8e3cfa98856fb202ad32e19bf20524fbdec0c3b5e0f21a119a2ce26ab7b4180da9d2f9927291eb83f6cea7097580898
-
Filesize
2KB
MD5d597a90e9ae1728a684c1559f447fc77
SHA1a7062f5be667ec6b744cffbf8c52d04c08a89b8f
SHA25632c62d429d0b13491b6e7c296e12196428e96b5fc8f9b376aadd5b99082f929b
SHA512c99cc0f6af6b57a8fc3fa58f3a14d8ee3d482c7e1807639dfe88a09744c067509681440cfbb3eef28b6de484d34f5b9111c51d7bf7843bab24a483444bf0a247
-
Filesize
6KB
MD517e1c53252f4fd9c5c6d608b10658d26
SHA120b0a02f60e0e7feb82dab405cccfc8ac92f26f7
SHA256083b0d653b3a77cdd67b8c1291f29439ab3c3f00db31b8d4e5e431cbfb4b427d
SHA512bf1e370069b47a37fa822b5a9b436b65435cfa5385ce1ba64bd313655686978152690cbd8867d39e632ae8a1cf1806b3cf507fc26329a09898e6665ebad83af7
-
Filesize
1KB
MD518a2863360c3b8164c2d39da316c066b
SHA1197fc04997783ea2dad320d17a36f1bec63a4319
SHA256a317bb2f5051d495ea4c4317af7d81f3f26bd807f8bcfed7d05ff4b2ee761dbd
SHA51235a1bb312dd97c61014bdde9606f81be35097bb3cf04512531379cb25abbe47e871e9775791df3f1c5eac0cd933c2e734a4239e8d435123f9db5df7853898758
-
Filesize
1KB
MD5a28baa95844daa366f9ba0b5e75efb71
SHA1a377cb0348079240560ce955b29e9dce9823ff22
SHA256c7b852d33f3bccab125004d8b7ffeba5958bfd6f826a51950d7c30986b49e14a
SHA512e1b6d61af6e25bf1cedfabee3ef794951a8dd6cf7c629495bd69da156d972744afc8bad6af5ea3c3423bb4ebf862fee54a7726303e901f696dd71a9bf6e2f8d5
-
Filesize
6KB
MD51cb5df31230a9bf1804f2c6d072f7142
SHA1c9e02cb88ad56133a9bafd22c6433efa10afb069
SHA2561606ac788fbd908de3aeaeb6fd6fa991488b22ed607748b501771f720c73e03b
SHA512eb56a9287cbb8183bc86b217e4eabf59ab6604044a87116cb23685224348518944209bb02e8c5f5dcc88bac3f36061597f1a9d9eca84caf0a93820b8c744a635
-
Filesize
6KB
MD510b0178b707fb1aefb80cc81645db83f
SHA120a02a610b18e1c97ab4390af596cfedc959a534
SHA2561475f0553edcb5e23a4f0d20b3335bbfe486262a3dad647a5feec263f2b25643
SHA512d221ae2ccd7930bb8e432aad43a68eb1594aca2d520eb994c84ac63855b343c7b252214eb889ce0aa0b523f4fb28092ff719d29828600c08a8823a59f7e4a782
-
Filesize
1KB
MD5fce400aec6ecfd5f249017a78bc22d9e
SHA1da4fd64cc3c387582baab9b5bd68814cfeebd411
SHA2566ca86408d877a5f0ef2397e5ea0a35bbfa79caa57bab687dae462ce834881104
SHA512a3f3557c4a485d522a8c3d7dc342ddfe37eef32aea73e0970e49428e4796deebfb0eca50959ac768e27f75bdc3202e8c68594a4b9ec396983c0bbc009ffbcbb6
-
Filesize
2KB
MD5766792d458b32cf79a87c2d74620d992
SHA1d8268ae56f33ee8a989d7c24c573259ab375d5e3
SHA256db36a522c76f40f65ffb9357d6c47a894e840bbd4eb1cc9fb222a162f73866dd
SHA51289bbe4bfc602e2b3390fd57a2eb908952daaa09a7822426424ae6c46f78d9383544517f357bd45bd995de0768878252f6f344c9633931c7dc627a08c728e2ee2
-
Filesize
1KB
MD5145bb3c5dc037f13906a5fc528cd8b4b
SHA1c3f0d72a0e63aff6240f795a2b8fd172fc5c3fc5
SHA256b00d90b1555d97eeed49b2671b8fc404524b2168d08f601292b046968ac6a605
SHA512a68787e74850eddc14f396ee3733876132fac41f0d7aac75aaf0feb5197af474bda1b394cb19c6594bc1cb7c2382f949326b40e61f9ac245912b6faf9c4e9a5f
-
Filesize
2KB
MD5399193a654e0508798eb0435583c307d
SHA13f2750d59a4dd6d9fa4cefab31e7d5db89f11537
SHA25629fea62d07a8d9ba0501c519679eb04500e941ad4330d46cde974c0660d54f09
SHA512c42f3986c7e7075ec2321c7a24658cb1d3cc96c29f8518414a78d73f744b645a255061258ab4b06765c6a2210caa73c49ba91bdb6a8f466c016509eeb3bd6679
-
Filesize
708B
MD59c705412786bd34d6798554e35ce59e8
SHA1710397d5de0768cfe899b9c6310613e6efcc87e7
SHA256fd976f3f6061db2fa933f97a60395863db28043859f476a65b2045ef69accec6
SHA51271667030e02f37b3bf48c0ea3d5e6e45cf1cfb62789020e21b623b58db1b647c09449366a0a06d14b58828ab86dfd8bd86e8c79639493bf21212bf776e83d55e
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dbd1d3a4-ebba-4cc6-a913-afa7435fbc96.tmp
Filesize16KB
MD535df0aef128db236d8c2157dcc4630a9
SHA1233367a756fd8d068bbccd47a51b06a5ea74af4a
SHA2567087ccbb3fbf4f2707ac684158524ef402e8ce78472f57e6d7eb60ace0610580
SHA5128b1e0848a36e7d857c99286a5db553e3f9959bfa3a9bb838a158b43f08e3e7ad600459e5052ef9e59ed17f5811b42b1337737154b1b1bfb14de94c20bb826db1
-
Filesize
26KB
MD58235f98068f731038d8520df4727c625
SHA16ef1e3ca36d59de490e593ec195b632e8e09565d
SHA25698280dcf81e7ed7a29b2d383c12027481bf771aa6358012ee5ffcc8b3af21e38
SHA512d75d4b688898ee9c9ee07f7be6e9dafd0154518ac54042270666969dd15dbc3b7c8cf92997c510f42f20a5ad8270d5324dd8f2ef91666a9d6d0450d60bacfd83
-
Filesize
11KB
MD51891329325f05be957ad372c4f33df8f
SHA12d7e2556bf7631daba7a728b2c1d114724511d37
SHA256580d882dd02de4e5d82044311fa772d3feb106a4c797726bc2c5f9fd848e2ff8
SHA5129f792032d9ff9658a118fc519eac866fbd9cff071504eed611c436816c597c0e9709e83e0c8f11723c28b42d5336c9bd9f60651096aa18044f4da72ea603d07d
-
Filesize
11KB
MD5beda965b51a4ecef244dae092b8c5324
SHA124a13c445037835b5357eb34c36941ccafc918a3
SHA25601d96db19a5c34a7bb0caf5dbfa53a4e44ac1e8b86b76801401b855892259224
SHA51267a348fbe0b6680dfb381dfc888cf901664681889d908e3b876d4829c2a2b7ac3003ff25ff3626f113cff3e2c2bca3045e1323cf364c96b1ac2d99d5757d4c75
-
Filesize
10KB
MD526d50fe71f95196e63942716c1beeae3
SHA106eea337648273e92f1e5aaeef4bf1cd50611f8a
SHA256b217e45cb58a3c6c1424f2b4d12e0e2a92cc14c778daedc03b5b33e1860a1fdd
SHA512a5f1e3e19a63f7cf1573dfadbee8459e13e1f2fcb3d70338c7347e3e28286b6f564e1871bf88b00cdc470722c3a33cee91c94a6b09e75bcd2ea91c06dabb6071
-
Filesize
11KB
MD5bc3ccb6aed9677daf1e00eced72858ef
SHA16cf3f427758794b4aa2f13f86a831e17b3aec27c
SHA2563c94aca4bdc29bd4f31690144dc678a4121d5077ab65e212cfb65e20f72a1886
SHA5128439e0ca45456eaed26b21422711d95263a952c2271087de626f5e7db9dbab27ada584b49ca1cd0f487ae6946b05d384d89221bcaa6c54391ac5c284b7446962
-
Filesize
11KB
MD5f5a1d0b5ceb49dd009a014df5ca10a03
SHA105a84f20a6b37d341e0590c43add57747b57a59e
SHA25670e9eee5b31f4dc988c2bcd82cfb751110aaa1b4f46cab97273e8a3bb6c5bce0
SHA5123808c9ca79f58befa6f4617c1e47cd4fe75a8dd205ea7973f737fa226587dc97e6d0d4c3b0e23ad6d4467db2138a735ea4bf0b73106770e1696511c4776f7b91
-
Filesize
28KB
MD5e9ac607c0dfbd950f7033f4fae303125
SHA143f5322c09652f4c3f309950b0333e6fe24a9ed4
SHA2562ca5b5be8e6c39eb09acfb10a52736d97dc2b8954a6ef3023976602baabdba86
SHA512e1415d579b3803cb0e6baf5767b8839c7129e3943fd04fa492b05260ff3aab24a9a297dd8107e0ddb86691251a76d1c91d1a226c42c7643cad731c0af2d35c17
-
Filesize
16KB
MD5536088183e2a166627afc4db9024893a
SHA104df9d3b6efec5d36b0019bde230711dc768cae6
SHA25666ea5d98e50a6f6c047ce73cf90578a579d0800af0baaf004004bf833b34fc77
SHA512cac9b2c4d0a4c6f502e4255a5f38059b6e0275e383c87268f143dc39b6e7b359a0f3d198384afe97515288f7f68d186c9ce6426405f286450d407e4af4cd2a6f
-
Filesize
11KB
MD58dc6920be899dc47b394722f24088381
SHA101f71badf3dd0d13276e70521e83cb3aade7245e
SHA2562696dd41214315df843a50dd30942aaeb77d8be7a05c20fc8ce86d2d271dc150
SHA512154fdc250390247d07242d1b70f103eba703550f64b430107a06c8111ad673bff3b9199fd8327fd664c09f9c627b22fc52a1221e9aebe67cb1f940c785151dc6
-
Filesize
16KB
MD56a6905f0ba2e38de507bf30023c351ab
SHA181f1eb52eca84f2726ec756d2d0ab9a74a597746
SHA2563ae1d68d8f8ab0fcee89a2b170ba0268eba4a96712ea59d9d60c9094295c3811
SHA512861835a9d070d7e17483f07723202c394ca667c099b2c89392d7c9692a7aefb686b531da5265e6a77738cef2fd8aee5a51a31013904c7b103990dd0c8bc5a348
-
Filesize
41KB
MD55036e1122480abc5d5731c96722f3527
SHA17e69d26d8b43933d8d3291909f5a78a080299161
SHA25613f7c3561ece8f14eb346dc691183be5a77fb26f85b863c114e6d112d732d2ca
SHA5129db09b4a71cda4c8aca2d8ac0637607f0cf02d4520c0ec3c701beca15caeaa9d3e702eab6af57d1430ae9329b58f167e51f5e317838555a43343dfdf7e5e0196
-
Filesize
41KB
MD5bea2f2c57fd0938f810a390881b94483
SHA1868a05b04cd4d4d40ae9a40b04161fb666a72000
SHA256fd731c27d80914e34ce001f8152f27179dcd2ece1296d0a0eb03648168a8616a
SHA5124a26d98d634ca2606af36f9836ff2376f8ca810ee622112f3d70cc7af853cc99feffe7d63b09d5875f8f1abd7bda97bdd197bb63c682a890e3c218b4e3e56df2
-
Filesize
40KB
MD53ad8223a25e7f6bd337ce40cb84ef456
SHA15c94f4e230f5cc72ae812f203398713d57933a06
SHA256b8f5f6a0e5942c6b1e44048983e89912730266ef3d5d38029baa9d24f2c6b9b8
SHA5126f39d6965258ee64891d3257c3478dca4002a3dca2c04f3e63949b00089c17bed708a6eedabd50f35017c80eca43d0c04da568b0578fc97dfe62e73439bac899
-
Filesize
40KB
MD5bbc2e9192365d85203febcd55a0fc816
SHA183b86cab8ef91c20f85e3f1f6980137cdc1c3276
SHA2562b33438a79c55524d842f52a1c46ce816a425791db0c08e2ce71b8eb0cecdbef
SHA5120157075e562bfbe6bc972e1a324e654be12d3271b971bb22d123d55f1929b1e154ccaaf53e902cba791371025178120aabc05359a0a24b665c9a46e091da49a2
-
Filesize
41KB
MD5a291f402b80dd9e2d2e06d146052d99f
SHA163ed155630b0ddd26985cdb3b46168666b43c07e
SHA25666b1870dbb7e5a0e20bc25b422c93257e9360e6bf11ad9d8eff4a1821a819db9
SHA512aa5327d86e241c3d58e60fed83a47202f27e11f3304cd57fb6ddf73718326c53543ca654174c76fb9f172e2fb75e58ae11d7e048f9c04ae3c151a7c54c8faaa0
-
Filesize
36KB
MD59433986c4cdb8d79d21f1371d4bdf080
SHA1c86572f4f1fdf3eb1481acd1c76f66230f5bd988
SHA256dc7129494201a6d01200bc05813208517057b8977dbad5f9adb855d6a0061b2e
SHA512a5107e3965327b726e096b95dde73c9cfbc03fb6aff65a203817dac6ed2cd57dafdc5313e4e2db3c3e8b8c0484c6a27746a7a50ea359b013e4e4aadb7472ea58
-
Filesize
43KB
MD508090d9590cbdeb395e15432d4284690
SHA18b37ab4c19bb9d88a8f6b513f0c0d60711eb6092
SHA256cff002861a9584b7ff0fb2d57f103ea0b86a40a1811ee87ab70ea19c2b072119
SHA512df82f99d83cd5d96170a9edcf54f7e0b7ce59cf21ff2f02e60a1998762fbd4c9c2020f2e82d7a073415c55b17c4390779943032efd31e0b9622175506b001093
-
Filesize
30KB
MD5fa95bdcafdc252a2852efc9e1bcbb585
SHA12871edbed977a692d1a665ffbb3afe19bfeb7dea
SHA256c5752b16524ed8ebcab517d7ad313a21190a513a7be78f4ece57882d7c92f852
SHA512d07afca7b938eec055e3a3d73d277549b68641fa23a274dae024a5fe9b25b45b1eb84c58e878c3f45dd52249f990f29e74027c58fac4bfbf4c815fcc3c32bbfc
-
Filesize
79KB
MD5086593551ad7d767d748782131a3db3d
SHA199f4767b03d004e049a6e6fd8ed46ccb6c5af650
SHA25613de442fd29fe31f21ba68482d10470ee985e2334d5b4eec1fa661a0ea4b8ec2
SHA512c73350bda30af4150f6e082c54238ca1f48f1c142626a3995e5da5c259ac4a36348cb34612ee8df44e36408e7eb40fc46887520627a06364ae1007d13528e0da
-
Filesize
21KB
MD5acbbec59b2a4fe01ad2a7e1caf60d5e9
SHA1d2940c1b0832c3e702ec2bed0aa5c98df86220ca
SHA256f10059b17afc51ad16f0de13c9cb8dad636f9080038bab729d1c482bec9f637f
SHA51252fe310a3f0b6fc3d80ed691b9af37cc74789d69fb07ddf5965845d00b352b25e1c91ccb1d943debcf9c94e446ebb07713962fea854684cc49ecbaea3e8de485
-
Filesize
50KB
MD52b37f058da448164400517b0912fc356
SHA15cea51833eaba8cc15bb780561830a99042a3f23
SHA2567989a712c0a29d9c2dedbdca32ca0ffd3df9c06c274bbfc32e60c6ac804a569a
SHA512910f2fc5173f025d84b622bf3350d9bd785c5e85c0e5f9959830c76bd157aab867744fe5f173789ea595ec7d3a582bceb91e1a6ea228afbf5e29165cbccab2e2
-
Filesize
26KB
MD503de8f68cae6ca556739e9659ba7bad9
SHA130aa905b7daed2cc1a5ed5b061f3f003d487e71d
SHA2566093fc3334cce30ed7b1c9cf448125cd0865446ea1aaa5911e82711713576371
SHA512da44e1bd373b2780b9478e7208a4f4d2e09aa0637be69762579b8224fa742c16221cae1951d3dc0a414e6a57adb3d7ad416fa9eae3388b5463d2a0dd62bf529f
-
Filesize
84KB
MD5a4c88e799d0162be44b8fc739685deca
SHA136ffc889611b369cea9cadf7de0d9b590a0a2210
SHA25654a8bd46433c8bd464a8bf5db037f1c13546af31ed9c778dbbf73e291d8a84c1
SHA512a3b2b33990acc5efac35d05b78daeb6a43cf997c0d3273443ccd4f52ab0279579fad21ae77c66dfd7d83be25075195598b0fcde3d6ebca7e8e0eda68515736e4
-
Filesize
44KB
MD5079347faf08be60a0ee2b8742b5ea974
SHA1ecc7a8821eeb022f38a8b5b4fbbf2c336dcbc7f9
SHA2561e12f80aaa9af5101710a29e9463e84ff44e9e3af928c589a6c29722c09faf68
SHA5121e306b13decf5687b14d3194ffd840c2b1424e6d6fe7c34b8076b027b03f11eeb4e63a1b44a9a6ab5a4d182d8ba50970a91bbc8ec067e5612b61878d315d6baf
-
Filesize
146KB
MD512617aa39b87128318aefa6d49468772
SHA132ef23ad418305b6db993fdd593ae7a12ec4de7d
SHA2560d808aecd8d2afeef070cbe93f79678f89027deabb5a414df2421aa7d1c835f4
SHA5129e05220af715ea5b1233909beb6d61822481e0b27fcb2742d67a5fa1737c66d32a12d90f2ea15962f3a1d9945d605bc0aa15ce36b3bc61ea32ea934c04d04788
-
Filesize
124KB
MD5693fd6cf691840728e9b69e2484719e4
SHA1f5d72efe1690bfd403d69fe8b0fbf2d5ae7ededc
SHA2567379bf8b463f46ab8d925e78a0f08ce806caf487fa468f687dda1d2a071d65ed
SHA512166e407a965c7856703c4fec2459d77079357daeb20a021b6c61938f246a6f8c0db5e55543566e53a90d112f7c0ba79e0b2f8ff315323d15202290a274d8df2e
-
Filesize
16KB
MD5c03246acb6a2736f4404fadd86bd7100
SHA1e9005aefef550076c87d1930feabd346df00f874
SHA256af859db11244c077f3c07ea7e7f779c2f5f2e0676c56603434fe6a61aa751d59
SHA512217d578da0c949a0a1773328c86d6babeaf5a0730d4762b8dcd1d162b01cda14ce261a1e33187d9bba0aff678e0795fd04206bb26d5102ae520002fee31e76e5
-
Filesize
104KB
MD5d7a9624777768585b192b954246f2924
SHA122c6430c735aefe12a564a5dc6e36443f496fc04
SHA256ec1517af9a6e24b331ae640bc1505e15225a211444940bd87c0016d6e275a6ee
SHA5121e234c80d8494f82223ff406ccf9ab8afde6a15aff0aebc604ead76d9223dbc9610a0d1ec00261fb7fa035c53ca071d83c70b797c7e83e526e5897902e6940a1
-
Filesize
46KB
MD5be16f2c911bfbf8690c7186e7e831444
SHA1973c99c53b549ac4c5a0ad95d1ab00b91b517f80
SHA25645d5a5f4dc731206ebe200acf3c5583d11424e16d792101e463743ed18a485ea
SHA5126f025d6fea6022c496fa7dda3d80a1a25d06dcd3db71327da4ccae6ca0287cfc361620c9c43a757cced5609838b6c951dec60de64fb1cf65de75413441251d62
-
Filesize
177KB
MD5b28cbfb17e4ea07600e7fb8baced39bf
SHA15ce5b4b20dd16393458a283087ddcaf317227089
SHA2567776228e5b47c3e01a51f3310d0eb74dce8474a675d542151eb1c293e04637d8
SHA512babeba58ea4fc9e197bd049a760679d129810623e063bf0702a0c0716de218dfbdb522221993940571213760874ca309f3e5b176bc7df39455646e413b65a625
-
Filesize
39KB
MD5153557c559ea2e10b8bc312cce950de5
SHA100d830aa06b8b357054636644a6e2b0b9f77090e
SHA25629afd98499e84526fcff99d94a773c134a85eac2e7ff55aafe0583efdde2d024
SHA51205a5da886f4fff7f71a9956ec88c0c21c2faeeb763a384d94afb914c0727d6a2880c1482ab507571ee21ed64d818992b0f3506d009bbc38dec6496f7bb97214b
-
Filesize
103KB
MD581c041e5dc29d7dc9d16cd7c8e725a24
SHA1b9b5c6b0d5b46c991a2078073ca8daac88dfaa84
SHA256b8ed057550f8d1298e616296823662a6331de234d77fd6a8db5c421343d043cc
SHA512dd9281351cf76964cc63679c61ffa3c1e317593c832ab71d41c9489b7b658f0f5fb608f6c8ba5a32513fa1fcc9f2389dfbcbc3da3d5efd90139a8b1d69e4ef4a
-
Filesize
62KB
MD5c077f143524f375831d4cbac25f35700
SHA18801e1092762d7ab91971a01079c5805db3f2ad1
SHA256f74d30563cfff0df0766be1414b7447acbc0fc75c0b2193481d1beb9b4cf98da
SHA512289f2ff0b5540242f4b9876cb4c555313de862df2707ea5f02c58625e88c48ef60333cf7d98b3b1a57aff8fb727a8dfbd85294523d97480f3e4478e5dcd18594
-
Filesize
56KB
MD500c0c21b1074585d95821c0eea5b61ec
SHA18681eaa015046f783f48fae1805af9d803dea789
SHA256ecb9becf438553d4136c18b82eab32a292e60a15f4206fcaea4407ac557b0a19
SHA512ed5ec6048f1a790a9102bb17411b2a59437a64201ec63786c3e34b871f756f0bf7a370fc02c665407b46b8993df3afc2006598573bd6b76e4389f227e54be239
-
Filesize
56KB
MD5574871be4b5c92ef0461daae0789b4e7
SHA1c51501309fb6b33c8f605dd59c6fad4f58acd731
SHA256b2c195a170d953446bcdaeb64b686069a2e95cbcb0de8640fb11cf87c7fb6a26
SHA512aeb036d40bb7fc1bf422b5a82955365da4e7e5f8dbf33c0563f7cede41fd63ea9ce5fa4f8a7166e90d216ef7160b2f6a8953f9bee464b89946c261c6118cd84e
-
Filesize
90KB
MD56dfb140084554026c9f09a77f12f2860
SHA13014b06321e100bfefcdf9babf6d95d594f0b88b
SHA2567734fd711fa3b761c905c5a950e0d5f215eb6c9ef53da62c2eb3ba4b8f17f9d4
SHA512bfc981cdb5229ae69370b262ba3db91a70c712cea5c93c5382389fc5c6c8c9d11d60f859c8760adbe2fbe5e353426226186fc6a3718345fdf70ce388ced582eb
-
Filesize
96KB
MD5e6e56defe0b2bc5b17f1172ddea8c14f
SHA12b8f0cd66572b98e1fa19fe82084562abf6d7c6f
SHA256157676a3e48297adae13f8b3a29cbbef4537148a76871146b86d4ab8c9db28b3
SHA512a8ea99c8f2cc7ec99a1b7c75a6d02f7ecac88479fee45f09e9802e3ec5d38765311cd5de55a5ce9997784f8ba066e1e2a2a6b658bf852b69005fb2576d0beea4
-
Filesize
33KB
MD5ed5ac3c5f537de70ae3cf64a391c274e
SHA11c854a5885a7602b7d2052fc9ce932cee7e6bed8
SHA2561378964bfef8aaa51321b8a8e3184fbf2e330a64dd1ab703df90a97a8980a6a5
SHA512306a2695a0a5cbbc05672c83d2e3b983561a8d026b67787925e1a31876589181728358e1176f10826c38e4a0a5584871daccaa4e38ddfc3a60db5f2721d6593b
-
Filesize
200KB
MD5bb5e516ee8d9bc7a0ca28a6663ca01da
SHA1172b7f523c2cfce3481c5c387b057f8c7b1596d1
SHA256d4f7ae09b7c9d350e9a11200632fa8d334fe5bc6c0e15b919e385358f8d04ce4
SHA512839d0cf98c5b2c9a1d4e35a7ab5c2f8bcea62b4564da09faf459087a36ff9c9a376de198718a14d6ebc48ef1aaeb9c437bc8b1e6ce1cf6fab60fd18ca605dab5
-
Filesize
58KB
MD544ea6d78e236ec73c24bcc10d6d8e9a4
SHA1ef3ee4446ae791b59910d8a2ddb1090124469f14
SHA25627f6316660455cb0350a2b6d39747cba5c95a7c51bd518955f05407e0326bdc6
SHA5121edae35d5dc869936450dbf240ad70d787ce44dbfaf0fe0d97c6517762796d8e84672a33ba6781ae3234df30bd9d6545de1abd45ff410a92cc52c31a19261229
-
Filesize
52KB
MD52a25d25d7674d2ed47a1967fbc40bac0
SHA1349f094ebd4aed11186f2c004b7afe3519571536
SHA2563002a5aec41b4ca90749f4ab59a5e07aa8fb31dc955fe2b8e629db4427278b35
SHA5122cfd2ecd5b42f30427e3cff51ef9a741f49b68db5c5d17c6f9b05a7007113bb1e7a071381e9ced783f6e30079f32c65fd6735a177f330f9fb72a6c9347b09e1b
-
Filesize
33KB
MD5bd2a7d3944f0756e7bf4f71d45e91137
SHA1a09cef4cd8fd1fac5ac5a20c29f744436f25e227
SHA256a753d3d4d9acc09e00ea4c120515e5894b29ef0c6e36404b4bfa3a53bc41033f
SHA512e4901b565ccfdb6a3d60bfa5c3de7f9e456f36e3f707cf594a185ecc65f9bb54ee0ae74d77a21504741af71b8614b08a15d23e0b0d683c67512e96d9293c32f4
-
Filesize
59KB
MD58059387ef05542a44b41f25113c702d8
SHA141052d8398a83825f7e6ce50d9ddfa7996010ce0
SHA256d4a4a13ef3ddbf0b890d031eb4e7d6e204901df8d3b0e2d3a3264e2192e87f4a
SHA5126b41b023197483f81d12961acef44b844a66b206da353f49b7d33a1bd2526a5f7c644d82147524c977d51af8b8d2046b7bbbe8ad297f75d3e408591bdeade11a
-
Filesize
28KB
MD5483ab3a2ab827c9b71a8a93200718999
SHA1b0402303d9c7dc323c4e1dc47a2d142d226c5fc6
SHA2568c9f87ae2babb76be38cb063fc7b46b80154dcf075fad8615538d36420f795d6
SHA512753b03a9f6e364a5c5b5b4d0b7591879dc8d8920159e57c00e7acabe8e296bf3e72b4dad00dcdb65f6d439fb5b7a2446284c041ec1f89e8be3f6126d0d6bae3b
-
Filesize
17KB
MD5854e4b0072b8fdd48c3374d6dd47fd1c
SHA1f6b76f85a878bc72d0b8c5ab897cd89efac94e78
SHA25644391250513388cb67b990b80a0469d2a83ecd77fb62769cd8e582f300f4d75e
SHA512c64febc1e388a7c1c5bf9403d7a0b58c347a03c9d0cd048f72377da269eff7567081d5dd4e6867fbb3731f54854503ef71225f8f5dde4372a6529aefe70070a8
-
Filesize
17KB
MD542d18b064002ba46bf9fab295eaa3fd1
SHA194f2c37d5d50644c95ab6b4727268a2afa4c914e
SHA256f83f906db90a63bc8188321b25c71fa0d12a7ab8ccdf0548d543a8d981ae5dfb
SHA51247f4e3747f21a473ea3c62d359bf380c2e9347a72a736d5c469cd4a508fa6fbdc1902feb3fcf11321ab0baaf49fa1837422716a447d53d3d4da59c8fa674534a
-
Filesize
46KB
MD5d0bda28078ec656c9320d955570468a3
SHA1adc581fea6fb411cc4a014c108f8a33e3f56caf0
SHA256b261cba391ecf7f65df1be6d4efcb0b241edc830d4c0ede4fd6374fcb1518f62
SHA51229206894c9521e40ad931f0db6d39c6dc910ecbbcacab83cd99bc516698b3aea83c3077fb9773bf00ebe54ce2798b3a18eb2be168352f656c71443d05ed1a393
-
Filesize
29KB
MD59af9c1969ff0783dcc9a28aa72b5f8db
SHA117a6fb7858b7ea5cf4d41128b625f40f86709670
SHA256d3eeb1546a6eda57d826d82866e6ef6e923b28e6b3f152c3b9874b83f99613df
SHA5124c021714bc7b8b5443a2a915a94dd8b58b5d25f34aa4977d0b3fab8a9e301f2b3d9e1c8dd356b7426b8041b35226607e905def44762e6800dd617f1275611a01
-
Filesize
35KB
MD575d8ab5c4117661e95535fc5205e3e0e
SHA1cb6d419ac5fbcbb52ac44d56409486d6a2a65559
SHA2564cd80bd7d05d7c15988f8e341fb47a6ac88032d31f6fea743ddddd0423fbd32b
SHA512cb44db3c8193e087e1d72e2c1748512b1d4a95b36189b7b89e11fbc2927003b49ebc9e18ff3aba2324581636a77115aa299eda64cfc515e9a55d78ab80310cdb
-
Filesize
63KB
MD540e2700158046f1da51998cb0f71f8a2
SHA1a2c0279f8f0b7f47b48c5acd893b409953b17dd7
SHA256e907cf9d28785252f7764442205fc066eb73f9472cede3391c4ef9ad69d486b7
SHA51245ac1742a105dba14112a3110af5069eb19be7351f6ac412fbe49fa20e26fa19e4ef582d7c8057806ed85c53dcfba8ca4e65558f71e79e0c57833fedaa036325
-
Filesize
86KB
MD501d4dd2b509a81e2e1f02b6f75db794c
SHA1010881efddca9446f3e7fb9ace60549aa0f07ba7
SHA2568d8b7e34d97883845dc365265c6d741c421ae47178eac2528331374c3b0637be
SHA51203e60d10b833e0c132c4e9cdefb06066964ecccd7439dec38517b29b2c4bb7f8e50bcab07db1de1403314e2a78acbf4c812a34904e3950a46be7a18fa462dc7c
-
Filesize
128KB
MD5d59911dd75e13ec78e16d5533ee2d182
SHA13e513cdb4a8b8fb54f115647a3016b2c2caa04a5
SHA2560b04101ee5d74a522ebd7bdfe260abdd8e04e2142f90a0900a7652a64c317281
SHA5129a3b2ac194972ec433b050b915034bfbf1355f15376b58587e2157620a22c31c3e36fe9d45802bc741e95df04886a38a8b02ae61ff81b06152b6f1ffde6cd0af
-
Filesize
208KB
MD52664af3e9c4734d35ec96b45099f156c
SHA14895d07010f49d6876de71232162d4acd1d537ad
SHA256fcfb5458c21fcbe1ae5059fd6a9c86860d65a64b42865c6c19c3595b6ab942dd
SHA51254b0cd868281b129cdbbea5ca52f5578e330415e3ed2554aefd4d4c4eb63159d331d0f75474e3527226fa1a20dad221098d4b27e136a5eeb2bedc63ad1853b10
-
Filesize
115KB
MD5541148dcc6d116b408973201ab57508f
SHA1eaf41dbfdd81d59a721de71a130fbf1c4b8a9db7
SHA2567e3c894226c0be6f4b99c1ca0b1815a335f92048964fa5b036b270bb39b9b81c
SHA5129bb2e1e09049217e4a764ff2611d0eb0e8d8bd68210dea08ee10412e7f2fe77533c3cff9060982b0b644fee42d7df1771b88159dfe3257045827d022384c4d20
-
Filesize
20KB
MD587e8230a9ca3f0c5ccfa56f70276e2f2
SHA1eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA51237690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8
-
Filesize
107KB
MD5c7e745cae8b9c07f0e899aedfec88afe
SHA13af466efa720c09b2068084af7f2baecd0734957
SHA256d46c34861b5f59bdaa753d5bf7cb4c0689fdc35fa85aaae06196b874385193e5
SHA5121f2351f33f0c4c28a0b0590dbf33a821977db5faae8165eb6cd5e22cc06039481057d5c0842d9f143f75429b818a0e491bf1d6b030edc1de5ba9b73a532e0aa2
-
Filesize
171KB
MD5682130ba97da28d2c6d8d257d5ac4099
SHA1d4a6dc439fc443c450a1ec3e9df490a63aff826c
SHA25686941872935bdd87f9701426dfb664903ac87837a2f0451e335ceab7709d98c6
SHA51287d9747790c17ac98db6287e777b894bbba92774c4a1cd3b5cab40c2d43f66d81fb93bbd1a00003c30327b25f56321b99c10cd767c4d8c401eb0ffaeb34707f4
-
Filesize
1KB
MD5b5789cc38319fa8c7c29282284a9b436
SHA16735743cb7615b8d03e7ae88db21c7bf423bfe3a
SHA25647b14a60dbdc28c205cf82c68ace7793bdd8a36d251a13b24e09e06b9fe3290f
SHA512e13dd417edd5f225cbf754c05696365034b5dd5674302a576708d78c6e38b803e869b9dbfff37339e51c5b8f28c4860c824acdb005a54b935b3514dc176aca14
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407171342431\Opera Browser.lnk
Filesize1KB
MD5e55e4c6ac669c1fd4bd4f7ea25368ad9
SHA1fb9c3621dfa85ba6630edff858559026211fed34
SHA256903303ea509d0178002ddda70715cd8149712ce39217e6ce363ae920da91605c
SHA51210848fc26379baadc4ce089ec533b799f585fb5e9eb751b47c9113d691c8b39be099144dcc81c46017ea995fa786575f660619cc0178484d6654fe71d1f4a40f
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407171342431\additional_file0.tmp
Filesize2.6MB
MD5dfe86cd1ab9fe5055dba3ead830574f6
SHA1800ba6757bf301a918a800ce15a3853e3941e019
SHA256f9cdff6fea65207cde93c637cca4b92939359ede3ac7337c2048e076085e7e5f
SHA512d3d363a221a3fa7a010194965cb8cc7210aa17d81be094a3e8ee89bb2de684c3b874ce1c6c55e8109091a849874d05c1bae132d450dabe2597167782d0063570
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407171342431\installer_prefs_include.json
Filesize228B
MD5e5e7de42ffe3bc87a10850b4c2ac4db4
SHA12ab3f14c872abca0053d3508b6f660739141c1d0
SHA2564ad288bfcfa018d1d5e2d3b001fc1306621aa55b734b1b6eabc9957dcd0083d2
SHA5120131c572c870ddea00afceb0a2cfee5469c2b3bb1c065d2de7c0e3959e1cc59735f9af6ff82a46bde5cceca69453b031b112facf14b202418e1ab95c35f519e4
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407171342431\installer_prefs_include.json
Filesize1018B
MD57037d29a77c190549dec03ff81201942
SHA11f3c88e2cb290d89c232bd05aa911ba5ed17b324
SHA2566e15c4082922638e066e1e58035d62c15babce187f3980f5d8ad50528cca1931
SHA512e76e740416718fc75dd5fd30d0b6315c75536f364e2844bad39ba3b1723628a9a950a121d79a839cfd51503884c5c7849426a3a94266000213e506d9825fb386
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407171342431\installer_prefs_include.json.backup
Filesize213B
MD52cda402918b0f8365d60814e408d8bde
SHA191d4861b164b9e60e96e9f655e2446d707adc648
SHA2561c39f1f2cda63aa59f524f543c9641678cc4ae96781be77f8dd30a0f4ae9e02a
SHA512cdba8e94bf3d7cd5ada9eb776fd658d5c91c5f508b83d3692595fc7b796537f221531daf9b67c7710d97f9edadbd1dd65bb702e077c06f68be6b8cec468d4702
-
Filesize
6.1MB
MD55eda2cefcb4bda954d5c43ef152f1956
SHA11302de9ea21b880e9253e1c3a80f557f73b208d5
SHA2562734105ab1452f7096aa735ac9629a6feb4cb1bbc8cb167e9cdad8b44d700962
SHA512ac3179ea5b66116edf1bcbe3ad481ccab93fdcbb32219c17a392ca492b7ef5c9ebe5b2b9a0748545355c587624a40c92f6f2136d8aeabf987a3c00e8d92d504c
-
Filesize
20KB
MD5f76d2267eff21214b736a070247e430b
SHA1ec200af8d4daf069212270137a05f90e63cf5354
SHA25619787423b08de5f0c07d10fe218c28e5f04a95379383ae61913b81c5cac532e0
SHA5120ec8606b67a924c507cb8b0bab1700794d02ffd28091f836e1934f828ed21c523147f21b154eb0d4296e93358af47a9be38c570147beccbcc049e742eca360c2
-
Filesize
5.2MB
MD5fec00354f2a6682315b3681f2d1b1a93
SHA1ebca0e83b372c7451f37f2e7cb27dcb56ebd4460
SHA2560c914008fbb2f69c6b7a6adc372daf18629902b30ddbebca32d344a0ca59790d
SHA5124e32d84cce44f6c294724a3b95bbb5c7a3865a2056bb32306fb87b6f4a4b09687c4c90a9fcbd724e5c957cf19cbc429fb001f79ee9c1a0e385eb4a07348e6f18
-
Filesize
4.2MB
MD5787eca2c78ad1cb3be0164ca5a6a0027
SHA1ef35faeaa3f6160b5d796a5d20728c923afc761e
SHA2564be9205d00b8f25ac60429b49acbf2ddbf45abc7a3b5ae2c5ec1a9aaf698a758
SHA512228cc0dbe7e7ab5027661edec0652c247739501043add71c08179e04c1df615aa10d01792abb9727a617a773588edca290b974623fef3168f630efb96e364852
-
Filesize
2.0MB
MD5179281f600f42448004f23baa64312c8
SHA1a2e75a95cf5709b68bde694a820eafd1e3e0cfb1
SHA256e8fbd9884d2e04faab8e39f4b131ddb47a64d9708e8a20b2c67830ddd2ca63b2
SHA512443631616eed5d2545aeb4d56e58009b7242f9742a2245ef0c582698eae52c56cba1e745561a18dda573e216554df758f89d78be81e12193193362dff2a4e524
-
Filesize
4.7MB
MD591018613a3a978470a82102868356008
SHA1f9c9bf2eb765273fe2eb6f7f05cea547f32d5e27
SHA256d8c4aef6d4c45f25b68d07701cec84034d124cab127541f68953930cc803350a
SHA512940bca5ae2b0e768f7451aeedaf398b9e3aab4d3270da609112680b8b2d82f3a8c1797d693b2349716a8d748cb12a8769eb52d6fbfd34b2d29a4201baec1b715
-
Filesize
5.8MB
MD5d2b726570909777e14bf6b082bb7ed0a
SHA1a4b8b381a6829dc2c309cd369ca5a4a3b64b70f9
SHA2564a6acdcbec017e2ab63ae93e08cdcbadb9d91a53aec54b5aeb99a7a3b45ffbb5
SHA512c5c60e97a617aba3164686b31fc8215c42734f9822e9a84c6b0d892b7e478bd904f0e4b86cbc287b6201f6184b0dfa520f9bf661378ef037de6dbc577bbccddf
-
Filesize
6.7MB
MD52525f7e9fd6c474ea4b56c239545f19a
SHA1ead7443e95c8f69f263811a547d9ff021c81f690
SHA25658e8871796011962586362862756319e8e03545499eaa48e93372f12d57ad88e
SHA5121899027b9f769eb895dfba50730c5a9fb2a9dee184af2c4e9cb28a31c998a3faa4f1da3cb40e6da2c065d101e173f76c403d86067b4365b99e604b5a4267f82f
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2.4MB
MD5311204ab754a99aae4e243396b09a93f
SHA18e55068119399daab8c29aea87a3782634f50b84
SHA25672cb7ac4a28c9a3cc8dab21d7a32443535c6e5904a7db2653402c74cfe160704
SHA5128159e2b97311a6b3ed1f9e6b02242a03895a15476570caa6a05afa0d75c7150d6959115473fbbe5c92c0b2c4332fc52fb3a2e89109ef7e55f3a15396d8e72354
-
Filesize
1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
298KB
MD5a5c28707c5e04dbee7699ff8729bbfff
SHA1a229e4e88fad6fa382cd53f758af7579e6e10831
SHA25677d96b1c561454c31c8f0522934b5977cba696ab612475054039095aaa7f5513
SHA512cf55bab8d8b41e0024c43416ff92feff30a4711916afa1a07739591c863668ed796a4670cba694b48954d7c1922420852819f970e8dca3f0e811a7b59cd94fdf
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
680KB
MD512ae9c12fb6fd8670644c6056ecbc853
SHA11e483231f6bc31c2a04b5fa2351e19159e81a088
SHA256fc2063e2d7e1e3ff743c46b53048a99d35d14e2b48d20b2877358a8aa6f436a0
SHA51290cf0be6a8e61784f5a16399db7413704f796731574d7921fb5b6c1eeeaeb633f67d04e1c97b76c6688b9a4ab436279fd6cf58f2e2635f26be2d8e09b10d9798
-
Filesize
694KB
MD5981e4b4112693b19d1e558239f6c5c57
SHA16175ba49634b19fecbf0ea04ca150275880d8ceb
SHA256f2e73c66c52db7ebde113ae32f020b419ca6c953a1ca917d08cff15630605ab0
SHA512d88530862495e734f7ebe0bb3b0f4cb67f4ebf7b69ec42961e43688324035ebdae7f4c5a4e1b93164db7e7cea7fe6850cb3e0f8d2f6e9c4303a2994a465a2412
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
21KB
MD592ec4dd8c0ddd8c4305ae1684ab65fb0
SHA1d850013d582a62e502942f0dd282cc0c29c4310e
SHA2565520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
SHA512581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651
-
Filesize
22KB
MD55afd4a9b7e69e7c6e312b2ce4040394a
SHA1fbd07adb3f02f866dc3a327a86b0f319d4a94502
SHA256053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
SHA512f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511
-
Filesize
4KB
MD5faa7f034b38e729a983965c04cc70fc1
SHA1df8bda55b498976ea47d25d8a77539b049dab55e
SHA256579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf
SHA5127868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf
-
Filesize
81KB
MD5165e1ef5c79475e8c33d19a870e672d4
SHA1965f02bfd103f094ac6b3eef3abe7fdcb8d9e2a5
SHA2569db9c58e44dff2d985dc078fdbb7498dcc66c4cc4eb12f68de6a98a5d665abbd
SHA512cd10eaf0928e5df048bf0488d9dbfe9442e2e106396a0967462bef440bf0b528cdf3ab06024fb6fdaf9f247e2b7f3ca0cea78afc0ce6943650ef9d6c91fee52a
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
4.9MB
MD54096220513da54513e4a4b88db1901bb
SHA10d1d39132542fd8cd391bcb3e8572b5efa3016dd
SHA2564a919ee170f83ce07c72ebdec16e6e2ccfccb17a689936cd0d1012aedd94b3e1
SHA5120741a4fba637683b6e34461c732360c0da26f80158d9a84f0b6ee28ac0cf9ff64f12b007d364163d1738011da22b7e6a0baa70f4e01baa7af9276b86386d9632
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\cdffab9728c3192f.customDestinations-ms
Filesize23KB
MD58b858068c6090be009c9a95e3f684999
SHA1115abc7acc641fd93bf054e0605993834835de7a
SHA2568d6f12259b854f98d328b05f5104394b1ca5ff4e59a6768898b48e893368e534
SHA512cbdcc0081e6001a57550cb45e7752f306ce9c981ecb4865cd50915340abf86d3bf216a18fd8886593358531aac59cfcf2c21ce22680dad6d4e85593d296ad118
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\cdffab9728c3192f.customDestinations-ms
Filesize23KB
MD5c5ae766b84cbc930c0fb6717c2ec1c15
SHA11f04b3739aa3668686423e47c4420fa3da45b6e9
SHA25674ec7aa52f97e6f69517e797defc600366e8add29b8954755f22f9784f3b3feb
SHA512648c4cc80bcb2dcf613ca4aee606fd2b2f8bc22f3fd491dad307ba0499e3fb4833177000cc8031c0e0dc15160ff1c5aa6d70050f0dbf8083a455e4ed27ac2463
-
Filesize
9KB
MD5942ece82d21f9beede466adc77ae3205
SHA110793af3a3da5bbe81b409d924611f76297c790e
SHA256427b3272798bdd4b4962be421f432c0650b782facbf7e84a98dd91b46b63633c
SHA5125f31432b8ba1c9a1662c3f9235ca2bb9d2ab8a9454b5da186bc04496359eb3b4a7a63995abcff1ef85f1156dfc2e43bb19261a92c2d62ea8538b27a7d2a0caee
-
Filesize
21KB
MD5ab709e070ca6f0d9e64fad5d9a5a419e
SHA1925de49c3e52cc986728747ce31b307f70e12d27
SHA256c6bf543679889ca481b8a2ee1efc2ac4915357e6562013673649d2deec40a8cc
SHA51213fa2d30b609eb232736092d471e8fed2bf83202bc4ddada6f694055d166b5c42a355861acc59db57703a36d85c4fb995ba9aad56082861c0cd940da4051261b
-
Filesize
40B
MD5ae307b5b65d2330552ca4810c8e0c6b6
SHA1df26292a0fa4596bf93dafeb6b04b35641e54a56
SHA256245a62d7cedfc1688fb58de46f1a1613dc1eb7119f4cde121c5a69b52c33d4df
SHA512816127159d8a1e0bc67bc5a021073d5efd807c7e7c92342c6e92e59c714eac596a39f65c758b878f5a88feca03b2ad6a8584046675e4a753a81a47fb8baec4b0
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\107be79e-242e-4af7-b7fa-3ecbe7b48652.tmp
Filesize817KB
MD5beaa0b72a7897b0131f98579a3344d90
SHA14c7137d09028494e2e42474888b2c30f1ac0c6ba
SHA256d75e6387690073bc0fb923296c9525546139c3912a17fd885f16a975eca5799a
SHA512471a3f60482230fc2c46424c5beef2d5886f6dafce1a7e8181d8cf424f6d006ede2b38af58be3c9f90d0aeb906430a05fb2a973ecc4e851e9eb2e245b360aa99
-
Filesize
365KB
MD5969220265e614468f398f53c7f0516ee
SHA1bdc6ab2582f829dcf58b261c8232a7b30f925be3
SHA256f1fc27d57de0117262f6a708bba22ddc8b878b4c2bc2d47feed17753d9cbab49
SHA5129c3c7d1ca1747e47f0358d16e935485cc8195b5ce1a8854fcbdf4954043d7177832cb4c0b7ba3d1f32ae1400de4d8abc0936b864e7b22480efc00056bc5c1d2f
-
Filesize
289B
MD5733e05670a0b6501f2f2c4a9d4272313
SHA15733ebe569fa70e86941ce40442fcd7e3e3e0a53
SHA256383d06dcdfd32232f71917b222d515f6e5e358607e27c759abd066d913fff87a
SHA5127405d1f5218a18c9e85d636a4086fbe10bf342fb56036c9fd4f2ec7bce3a0df8310d62c407b70ce7dd79d70a470a6c7b666973ef82ff8caf506b48835ce93a28
-
Filesize
24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
Filesize432B
MD55ba281c87328f967e7e271db9bb9d413
SHA1fabbe6eef1994d4407844e9d737ad16d1253d30d
SHA256fdc307100343b8cfa182ea1aa92b9ab206ef9884fcbac1fc721edb6ad383f9dd
SHA512fbe272e8cd97b4a6336fb4ad71524c7c1b222120057d628776d7b56052ffb8dee9b9481dc69ed0606161175b93c344d47bb65ea65c6a5013777cbe4c5302a74e
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
Filesize384B
MD56471bea3ac2b6c338fcfefa3948a7c2f
SHA140cb6b54723e0a882cbddf7370c92ddec36af27c
SHA256d845033989970db38a9db6f76ba3d9a52a0c3bb9beb7f41fb66d91ba4599f640
SHA5129eae637f833f811fb2ce0db66b3f67dc0008577020fd20e87b3132ddccc8070dd387821c8920b7929a12baadae000fa98f13158cf7fc5f19f9e80039f9942b54
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD57aa5bec675fda37fd21d8d48d4246f85
SHA12f6c698c0e067aace215ead7a9fdd53c0e1785ec
SHA25683230c8262bb859e9ba13140c75196301a3837d10ab2ef642c175d168fbeb3ad
SHA51293074ecdd61eb7713b48c6541dc423d728a5e2c41826037c31732a840c953d045528750bb2269ec82bcf4bf5f2de3adc39c8e61ab4c40e074f52ddf3615ee8be
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD5c99ef503f449a1a504065538f0ee4edc
SHA19f26873f82b62660580171d84c8842a33a6d0989
SHA2565d0ef4b55a1012a3c88794f0a5e8261d285998042fa6c4f98b7eb1c07c43ecda
SHA512c1fdebc12cd9b88312587601904fbfb70b1b6fd3a8771e777a19188528aaef34151dc9ec184e39d481469b58fb49b0aefc613fb76a88d0d84c047debbc79e51c
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD5eda434c4b7824ee4855c9bae16e96c31
SHA1ea62069798168bfa9c34b1aa9a5badc5e2dfc40f
SHA2564c9f0ff31b606ff9e7b6d7867a887403c58b29ee5b656759d0f969ebea5cf89e
SHA5126d67e869a24778194ae8ff528e4b67e79545286e4a443083cb519cf423213b196b17b4d500095a8c9134dea8620ee83ac02d40dcbbc873a52977cd384d46eecf
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD564fb0e25aeee2b8fbda8c94c4487a80b
SHA1ea925e2729e83c38a5ea1149b0f43288272c09a0
SHA256e36efdae723d9f5202f17a444eeec7adb645d4ad1c5799052a82c7a3e9588ab9
SHA512e60b28a84a04bb6be77bf37316c174d9c0968d3f392a0012f018c2cd6f82d38edfd02401be83fa9babd2914fcff9b89e53eceba6e251a4e485f21a2f6e931811
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\gojhcdgcpbpfigcaejpfhfegekdgiblk\1.19_0\web3\dispatcher.js
Filesize1KB
MD5f76046e8dadc97089fa540da755ae94a
SHA1a9448799f6b026bd25afcba7586d3c420ed35f1c
SHA2565d638458da2dc514d521f481f90d932294fc8ca0e18d9f83c9b96dac2d360580
SHA512a25546623c035ac5a616fe1f3dca4edf76e604fd1118980656f263c92d90357e58a861a7a0e7033be725104044c3c311dd5c816c5acd26f5e4d627928d4970d1
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\3.4.31_0\popup.js.LICENSE.txt
Filesize871B
MD5df32743ed051aa784d347b8223c278a1
SHA16614f0ce1e430b960e0a4ed5a0dab97f1a6c4dba
SHA2561d438fddc659f353fb3db7ab82216a55e71f6aa3afa2539849e68192037ea627
SHA512c1297c68dc205cf24eea15af69faf14345815e67fc488cc187bd270984a921530f541b4bdd29831305a43d6704babba17534e3f7b2648f2b7633f48ba8228f08
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\IndexedDB\https_web.whatsapp.com_0.indexeddb.leveldb\000035.ldb
Filesize5KB
MD52a07f5f5cc6dcd83c3bac02ac6ab33d0
SHA1c48d8435145666e75ad644fc763d62697b2581cc
SHA25600d8348133bc05f3e0ad1f86074e9bd5f8b583af4e7eef9bf38735b6f670bcb9
SHA512e59df1db2484f7745ed15c3d2308d8683b87233d8efb4ad5e4d3c4bead877c77dd04d27f7d9c3866301febd843c61bee2c5a88aa8940e981a4abaaf779b02369
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\23ff155d-223c-4375-8157-d949797e25f3.tmp
Filesize27KB
MD5dd8e6df155a2ff5f53f81679d8701c70
SHA1392045fa8c2bbc94b569ea3a70068c8dc8d34826
SHA25609b4f9a23cfa587b071052ac7cd4803139d3f1775a11b4c552b92472d857f460
SHA512bb1b9a80f15288056a5792ab509451e841c7ad7b654fa7bd5b862bdf298ea8421c201b237d9cb4f0b64d46c40d0bbbc229161730eca3d5d957e12be515764145
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\2f884bc8-48d4-4ab6-be25-a8aacfe09889.tmp
Filesize27KB
MD5248d22a0544f7e33557ec1e88f1b8016
SHA1b62b209620c2421315784f42b6842f62a7b5168d
SHA256633d6ac1673bb44e6ef6581a98b39aff384daa9fa25159a9c4ce40185894a6f3
SHA51215998f7997708f0110d1f3766ba360cd82fb6d7e0dab09711c3e115bd826c0759782adde739c2d76e543ffd1191f7e99d7cc07b0ef95d9c0f9ae42454355711c
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\3b90e070-3a5c-4349-be09-81ac1db79f38.tmp
Filesize27KB
MD5a58d634a154876ba9ee6b7489d03ba26
SHA1124b5560848619561d81038d75aca2318255b626
SHA2561a6621155ca28e1ebec2853e1ef866eb82120eed8bd35e4a6b3eea3c1b70de88
SHA51236e1adf11fbe1fe40165fc6789c54d9b9dd1f16b0247fea3ca1219db6e4ecc55120de9162456a61cf7307282e7e07e2a6266155c50bde48d53228e9844fd373b
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\47856b9e-e3f8-4ab7-9618-eab357ff8b54.tmp
Filesize27KB
MD5c7828175f89c5a3ada16fc7817c80af8
SHA1e6e6f4dd36fb419cb311093dadf8acb61db1d30e
SHA256b8f0a6164e126d0f70798a96f456487080b5473bee571bb9594600f8a53901c7
SHA512b68e7b8c42c6d571487841ad41148f7452e970b295516fe025744f7bbc8d0d7986699b41d5f71a6b43fd4ac28b6a216e24c19820ab01817c4bcfd50677fe7541
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\4c219ba2-ac50-4c24-a733-2d9b42e88937.tmp
Filesize27KB
MD54b0f69f3622e2fc1950b2116b5d46c41
SHA1d4a08faa52ee3600fc70e38d915050bf06c5b80e
SHA25639bd99139f46534251ca30ee1eafe846edde8f96356642e04b68a9f2af9799b7
SHA5125926cfba0a17a4b65773cb1632fdf5da533a158fd4cd58e63879e16e91d7dd222214056941ba0bf80c654764bee2c5b7dba32468aa933f26da74f5fe80b466be
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\87e4d862-a329-4d3c-afa0-c22427f5471b.tmp
Filesize27KB
MD5309fa4e874c0a1a5e6e6fe129be59481
SHA15ba36cbd85535fa73e355d4bb72f8092e44a7c98
SHA256750f88c1d2cbead44ca4a3e2d52dfbed8a5dbe149eddfb63e71fa4c6380efa93
SHA512ec253afd37c12a6fb4ba6c68b2fc2bc507280dfa0520e74fcc12217b2954a3f2f50d4a5a2aadcaa1c44a45bc6169d5e1ed7386c90d299639ec60b40c76bc9625
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\ca8e5b6e-8d16-4e97-ba09-9c9f26e5af96.tmp
Filesize27KB
MD5151e5c66b02c258677716d5392e4060e
SHA1bce5984e67550da9ec3beccfabbfb4964097ef94
SHA256efc6a2e88f3d3507d701bba4af3fc6df8d876525be247ec6777ceee08451a472
SHA512568b7597045a54ac2f91fb02c5f0243d9d1350df16ee78d7c33adf2528d9b9ddb85daae27a63329ee17464684a712b267b67131c67f076b43f114ce50a1b9efb
-
Filesize
20KB
MD517b48ed222c328cae3f97c6295fb1a3c
SHA15f49e8f43170d6fcb6e3a06e5fd159bd7b88518b
SHA2560e6966e1b68116b3598b7b6e2ae161efd565d157eefc08bb994048f1ee16c3b5
SHA512720e31a0d486a1b08b5718c95c9dd20a5e83cb67631dae877fcce9d98c70c1f1f239079fb169d9a0771b6bf16be27cae6ff17259e7cedfcd63a70dfc1129bc00
-
Filesize
2KB
MD50cd80dfa049599f533637f3a6709ce86
SHA164d5bdbcd127a618c445d0a450066f564240f1f1
SHA256abf3b40ebdf55fe7e7260345485b7319696c0fc369e0619c04edb04a0796329f
SHA512404576588119b8ac387480e04f5635190378e410ebb15eb781bc65476ba932e53f667f47792e378f9a52a6296d2d479eede9c6bdf85a868dcc8fec1e6960e87a
-
Filesize
25KB
MD5c5087f9eedd0f7b986e304b3a6694412
SHA1992df402ee0e1aeb5b5b95f3f94d9aa92967b641
SHA256eb5f3c86ea0587f899e2c1066d929e82f56744c422acab67f72f311752399b3c
SHA512c8d0d22f09efce11f17603a0e07b0bd9a0f5dd740fca300b1fc035f4f684c27ae4315a4c66eaf2b6d3b32a482aa58d845db12e600532f767d1e037c4a6a79eb4
-
Filesize
24KB
MD53fac253a3c5278ee1955d1333e22cc38
SHA13321cc196bd7ec6f75d43f4ce1e1508e69558fe3
SHA256c36b51a727330b14d6e4472179e4bfe3d405b092a35ec4ff0ad2b152e910e979
SHA51276771e9b5a4adae7dd96db1d99519f5b6d0b92c97e3af402cd6b86076581166e01997b3f388904246df6c3b594b810d173b89de5bf112004c0fde7254118929d
-
Filesize
12KB
MD5766b1e62416e25a00aa165c05b90e04d
SHA1a51f3577b61a5ccb6848963b461c99ed49678b5d
SHA2564bdb909a452c0d5d1212bb5ad0b421bbd070f8ff9dd5924805c4623bb9a15742
SHA51206d16ce405c3ebf3553e69fe2d1836c21863faa76fcef3f5ccac9fcb1020009419cd3f4af5fd9627852edffbaa5938a5886e2bb5d4422b772bb50eea38ee0ec0
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\Network Persistent State~RFe5c66b1.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
1KB
MD5cccdf9633e87c99c33093b635e1e1ff4
SHA171d50b4dfff1f5caf3b1e28b0c007a011fef2313
SHA256acf819103910f3b6b86f12b8a7526267c9a5c6ce1daf83fcab6c52805e410e55
SHA5129b0b959611efb49890272d5e6de3dfa2f0c9efee2506f92b2c914b86d8ae98a7878ab314e1732170674adaa1ca461508d9fc6bcf0611f9b932b89b33d74694a1
-
Filesize
1KB
MD55f49f29ffcac1a62c305c06e0bca1ab5
SHA161f2d07149e00ca060a9ee19922980f1df668650
SHA256cb9966fb2e1770039d019da57619cd2df7e005cada95a4c63af9d8c7487036be
SHA512674ed105cf58609e129e03b10af9618403d294688dd07a2471d6db55f2bf118e1a3f4c1bdea23dbead30b40487a35b5dce93b1f2cf5e186b284ea22302320ee4
-
Filesize
2KB
MD5a9346df4bb434539f77d14ac7afa555d
SHA128ab2aa173b9d0ae9e0c2638714a0edcacfe7994
SHA256c617cf210005819b114071eb395ee9351dfde46cd6416ff9d8728695145bc87a
SHA512026a6e8a781aa1ee5ce0472c44e578309446c1912cfa09af1dc89672efef66d8cd0ba6cf709878e4b8751fbb1acb35b3f951571e06d6522a9cf79e99790d40a0
-
Filesize
6KB
MD572a5d9af2f01329a160456828e6230e7
SHA16b81f1939d80d517b276ee4cd298b33d3318605d
SHA256fcf95482fad51d10a9145ae020456a478c00db578304d165c96cf2ded6ee9cd5
SHA5126486e700e4464496f8b737cb01e842c76547baa882d52f2057eb9ee51f3c3df2654ba24d8fb24d45dd69c9f00b8ae07b6c709fcf50375a259c154b3351a32a3c
-
Filesize
8KB
MD55c0af2aba1ceb7174df0ca48ded14a13
SHA10ffc12111057ea33df2406307565276211f10c39
SHA256639db7cce7dc9d56f0581d2b17fd4bd4dc95207220d02ade44a640258556cbc2
SHA512bab3613506706576bd0e90d37a083ceebefc035fdd6e90c8770dcd29d08bcfcaa67c10c56ee0e18b84c6ef622fd68dccd3c19e72760a06b00e85565b39b3f8b8
-
Filesize
1KB
MD5de552eaa4e51ce992e833c85c158cd4b
SHA188a372d20a54b9da9180d5eb87b8d72899eaed77
SHA256aa1f4ce35c22769cb148c0b1f66711ac760fddbb812acecad587da04a150e05c
SHA5128625698889d11ef6753ecad92fa3a751b353b57310bb7ebf96f096dee27b0c27588b8a216476decb328e0790ad5fe315c9b4ba62cd59300542023a44fbaf8545
-
Filesize
2KB
MD556a3a718d3d5acbbc80e7a0ca1361b49
SHA1bd225b06f08ab1a525c58cab1d852b422de3e8ee
SHA2565b65a493368a6d68c3aac0ec74415b3f6ef38a7163900176cb95bc9e721d3022
SHA512dc586243b378e2fe7a310a9906d85a89f76202412c48db68b0a9c65e0f493bff92b04b49379cab839bc3a861958e289eacef73c5f8af56b4bba84db99f99cec3
-
Filesize
8KB
MD5abbef8311a2237aa272242bfd2c64ba7
SHA16bf5e5ad6177383e87cb952b8489424d50a30a05
SHA25676541882674dd124141da918f56bd04c2dc15cb13f0c13be67a21cf4b7038381
SHA5123cd12f49f719a35c4ca44bf12bb4edc09ce26700ee422db117b2bfbfaee00040304fe2257fe61092644a57891564eaba48333925d5027efaa389fa28a609ac05
-
Filesize
3KB
MD53ca1b922015206270027489403008215
SHA12f689dfe7d564fc19b0e406b2362fbde365e0ebd
SHA256a23653201459b820ee3689c4584c9420fad9a2e5a25f5d7e8622c42660273f7a
SHA512ffb6314d9ad30f4e697e86b342697380d6e4bcb8ad167cfcb1fcb15a67d887a9a711a2313042f10f41c57b23599a5b0fff97ca18193f73e4609717a03244902f
-
Filesize
5KB
MD5da994aa6a8a148f8310a221775b1a540
SHA1beaaf7e38f13278b9c4dc9387b70ac2e7555ab9a
SHA256a4d1d20f8110ce1910dd1790bf6f2e392afb83df864c2f66567f66218df4ab79
SHA5128f94b6e2173fd11cfaba1f4f2848f9198121d6c7eddb74c6325e7f807b59e5849f05ba29c9c57f3e35cc2ab74456fba31ee3325bea7e36e868cf98c3b817521c
-
Filesize
8KB
MD5e3efc54ce21383928b284cae0a818412
SHA1049bbd0fab2cb63c80d529107238ba2394e6a903
SHA256e50f31453340148fe5103d921bbe410792524c9d728f1f74a54534b44845693c
SHA5129fffcbdae2b05024a87f251ef62b2308e385da77dc265109b9548738430eddb484e48111b73589921e9ec8d8661f318c58785e42b8fa8f12da09231e94890609
-
Filesize
1023B
MD5180261c270c9974e32899826d74542db
SHA1ff72a949060fc776fb036e84f4b05b392030c42d
SHA256790f2a88c4254043a1039132802e7ade91041ff0eaab9bd04d04db984920b7db
SHA512146c1ca93decd945495eaf3bcb09341971e3757c75d268bc0e69ff3dcab287144d022f8af57bd9d7583677f331d874180af0993b4cc2b215dc03811001f604f0
-
Filesize
8KB
MD5c0f333e7dea6504179307d2dbe61529e
SHA17b1771740b884b253f309b16d22e5f7ded079a9c
SHA256b7672cc2acbd4dd2999e91631d6d375845f018e1559ef7ed8b74640b909fb816
SHA512e11c83639086557aa3e72bbc57a49b895303ca1fbc5fff3225db403d579ebc20b1e9b62bf3f9742a1b803a20ae07ea9adda216d8d488f9f1726c5acb149e7922
-
Filesize
2KB
MD51596f70840881e125d3e4380834a6d84
SHA1324bebb919de1c0aaddb19359015374dc16698b2
SHA256ad65bf439ed8df568262d7f79b927578fd50090795193908334531b450c8d739
SHA512fdd2c101c9e904eeaae5cf6f31ba2b03534d1840f98e8457e7a8cde376f5fd5bbac3b07bb18942dd14cec1a216eea9ddae04356c8dbed06917c7ce5453970e60
-
Filesize
5KB
MD506b1ab9cbb419a9a142eac917bf75a45
SHA1306c9af9060dd89e20b3eab3671478df3ff14314
SHA256db6451de4ffd1c6d5870d9482c28508ad92f079b9372fd326a6302af002ae5e5
SHA5123b787f5b896f074ece5e627f6656e9e55331ba89f0c6944172d968536b2e0e05986f47cef936b48dc09715870c087669d96f9eba87598ab33e75ce5ad7ac7892
-
Filesize
8KB
MD5ab1dcc9f0f50507ab8b7b1362a913b8c
SHA1426ec5585d30165f0bce1561964bbcb4cd82b5f4
SHA25681c4fdae1fee1ba956db1e86b7f3db47de974fe263f5a615a48074b02756de9a
SHA512dce3f1d4ba1442991c2298fb1dd24bd8afa99abfd528dee5abab662d8593f665cd9c49bd3c184637f1e2ce580d3cbf4b519946b6aa07025cbadb6ea0af9e1f93
-
Filesize
2KB
MD5c92cc8a36d0652aacb12549096b8e9b2
SHA1320cfca7225cf13593abf201eb3a55edb15404ab
SHA2565e99feecc4f1289633c77e2c1825c9e6de7827e1510db3831109c8ac23f48d30
SHA512c5115f08f05ab6853380664c1c773838dc5112f3d4ae3da4df5bc337a4e2b16c75ea24635ab7c840d03cd44ec9384973b06018c884ce498c6fc4c447336af5b5
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\TransportSecurity~RFe5ba94c.TMP
Filesize1023B
MD58ba8b9360c5253c9b7469e20caddde3e
SHA14717257d3fd5bfeca91cda10939f0408f411690a
SHA256156cde967aefbd89a1151bf4593e7a9a15d164ff7778081d55270fe10f3af612
SHA512c0ca6e31cb579f4d82db7d33e916bef366fbbc57a220c3e8d556965a9b48f6087f18a13f1b6514eb3d6b7ae6a39f9768d4281206e388b1aa795b9e43e972cf88
-
Filesize
7KB
MD593138bb009f3e4fb582715e6bdab8bae
SHA1696a423a4299261d045ec201823c616b097d35a3
SHA256b1d411a7a61b71210856ce7f6aaf877d6b6f7ff04cd9c92c3b47ab4e9ec5efc7
SHA512a151a6d7b71417fb58a1ccc21b1ec728dda3ab733ec8087b8116c1f7f2156e14431b8a886227e504549f67d0231e0b69af74505ef554be0bc0ed8a2b41390454
-
Filesize
10KB
MD55b925f24f07443bf35d55867ffdc5150
SHA1d73fee5e2e7c14f3305fb26cf76409be3c5e3544
SHA256637e83bed186d26e2d8dd36ad982fd951829d8d86049aa8c37b271866707e09d
SHA512c6de40f882c78ca7d0e4675026d0ccd081f0b221b055ba5e36129c12e23f8ad7d43f86e45c6ae87c75b2ac81dd1d33f79a3eff398300c14ed2b60b1e41f6323c
-
Filesize
12KB
MD576794b4fd03938220de92485190d842e
SHA1f7c723c9bb3e0950f6c45862f649b370d3bb5373
SHA25607154f9b1abed9c09b71b8595f7b47d1f09d12bade61607548cb4be550d2b387
SHA5123bc45bb4ee92861f2163b12a8ad75ae600fb3537001ed8023be72de8e864adf34b46c646074dff5b17620dae97e0ec24bf216daf11053d735267dbc169266284
-
Filesize
12KB
MD5072d467045e33cc7b7042549e1ce0185
SHA1c89c710cac18a5ece9e09a80b3269a2110c7bb7f
SHA256f74b91951839bd012e98de52539c1c3f0ac5955d03cd6e31fae1bac89d01cea9
SHA512ee0c83f07697414b57e751d5fbce9a68c9e43c7c3dea7dc0c9c1bd30f07b5993c41be0f01899e9df26bcc8b25cd098b283d301f434d3819380ea8b4b42265f07
-
Filesize
9KB
MD5a22dc92c4ce2737a307151f7d8b2e98f
SHA1842e9ddef238f039e56143b9e1953f37c7942b08
SHA256eb877e8eb44e9813a58c4cc387545e354a96dcc09165e1be172e6b40f2061d1f
SHA5120f70dc321c4929666f6d2de6bd5d67a1d91d234ed2120c48b75fcb709824afae5c49514becf2971cf4eb80a4203ac8fc6ecfa061ec2d42e15365d7b227b7f431
-
Filesize
10KB
MD5283e6ae65cb4a8e47062db016ac99267
SHA12422fb6665c155683916d8fb885ef62ec162a194
SHA25678f1e0ba8d32b63ebd05780d06c3d77af8f373bee3c15f6c1d61a40b3de27416
SHA512bc1d25543daac6e528aafdc1529a0da17ecf6d507a574c45d15062e5558e8e1ca07aa33ee1b38d27bc2f3b126e71b17b393e495511e3217ffcbc963644bc2037
-
Filesize
12KB
MD5c1d35365f35ae054d9f3f4b16091d64a
SHA1e9a65bed26cf3a6e384685993c5b2089b74ca4b9
SHA25662d0386500d6c366cb9cc16de08707e17ec358998141d8dd2e2750f606f855d7
SHA512016e4972848b7b99647476afb269c7e35fd1f0040fcc6800291d5506107c76ef1e6c7ae572e4c71d92a639a772680591f1cec7fb53570f9f862968ada8aa3af1
-
Filesize
12KB
MD5f3012fe9feef103e40faa73c531c5fd4
SHA167d2fb892f9f7690ea24fcaa386cb43f4ae2a315
SHA256b8082ad66aaddfc04f33af16dabf71e64452eaea1d80a9d253ecf899bfaa24cf
SHA5129a7fad16315a45e7cd8a5f259e5419641e918c31ca529c16d35b240f62f56f81666d80f16ee64a6475ae5addb5642dda1df34e48308ee429490b1128dbeb0675
-
Filesize
10KB
MD583bdde829aff3e22741bd196de2af286
SHA1229aedf2b29303477614031928cfd2907fbba886
SHA256a1c81a42792fdf39922f986aa8f727e9934b109873f12b47a69997f138a58702
SHA512801fb30b4655c682fe2f860dc8441ce9da6e39ad4013458f92665f14ec824c5e57b2922ff2b33d9670f432db3ca9e2e610ead0bfdd3695bb243426597ab7d149
-
Filesize
9KB
MD5a20c5db7fee7ec4008015cc8c1ff37a7
SHA125e4cb3b37d670049db7eba4f192cb9b5ccde46a
SHA25680df37c2e2472f4bb99b2c1fedded922b82e2e7e08bcbc02bb106c28bed7054d
SHA5128dc2d498c315be0a721793d19915097ee2da7881159e653e649de227b606279ae3e11588af575a8abcd2aa20835877cf31efd6bf58876dd7007963fac0acac0a
-
Filesize
11KB
MD51d2eddf1a24203a034d21d6d19309a93
SHA16725cd616a17ea56df438d816fb27bf488496cac
SHA256d8e7591f1443f0e02c8afa30723541074c14123eb741aea8828188f3dad12c82
SHA512fe19923d23b8928ddc8484eee0144123ec7ef5cc44ea49dcec49f679fa412c004d0e99f69089d3313e27685fee671fa09a6dfabb55fc6d273b5916f3156b2c13
-
Filesize
13KB
MD57b5479076a236c776a4e3f2ec8a93ed2
SHA1b925500d44288c0c264ac17a398cbad7cd1428d3
SHA25699b2e6d058c2a65b26636cdef72b2ed5222b68644c6183a772450342d0c8de88
SHA5126306b942204522f37d79e10b71c4233a6239c0c739adbd42731c32f4e7ba59a12f9f2abfdd102ddeb7abe6ba1b2c7b824c8bdff8c6438f1e352a6a6c44ee52d8
-
Filesize
12KB
MD5281e7ecdcf301d48919059afa49d379a
SHA1e51312d8c9ec66072aca005d951a09e2e3fb44c5
SHA256ca9de42eb0634d209e2d855c041bdc48af1f5a6a86d61f2e7c7b5369acb043ea
SHA5122ffa6e9ce46577c4b3a384f697740cb569f920bae8fd0e5fad07a350131661430c8b90ec9097c13f084749103a6b425b8c4a24c7073ad3990489583a0b68abb5
-
Filesize
13KB
MD5b7205433db2f53dee3dce0b352ff35bd
SHA1ec2a975bbb7743caeacc0a771c1bb12535f52632
SHA256daa3211678ecfdb013c761f17daf855308e8a2a84e99bb58939dd4903057c646
SHA5126dc1964bd5e3cbe4cb7c4606051f2addb78a2e760c5bae503a44657d08ee2e29fad6934fe883e9310bb8fe3d73b4fce901bd2ac0e4ef1ea4cdca23f92bdec158
-
Filesize
7KB
MD5ad20f8bbed5bb991a6fa1a520fb012c8
SHA148b47e93e4d82a3ec5714eed85183945a120bd7b
SHA256a16f5610c21fa27fa061df54daa95fad7674606205fe6a2c015b96af086b5296
SHA5120bb28e8364c86bfd8181f83552d31b61b360f6f3788c90b60911109c22c6d1615bc4e1c8491bc95b159a589b88dc81e8c5dcdc5c286f060e24a87ece998d4693
-
Filesize
142KB
MD57c582b9f8f63c3e56122ad360da7572c
SHA1c628f353af2503192f54b0f07db17acd1132942d
SHA2561a07f73dfc888167b008e349caec67d818791d46a26c9b4a920701e9a74d5623
SHA512e851bd64e0cce0d5e826b20314f9953db3e5adfc06bd44d3443d8df19238602d5796bdf04c5c3e35337e7c48663a525b79e189c908cfbc1582b03f4de6f03cfc
-
Filesize
140KB
MD562aa89275efdfccf7a0908e27b9f50e0
SHA1b07f8ad778a411b42ba1028e01214058cb0a7555
SHA2566bf66ab7bae149cc948b9b5e73a4d22901ee95170f5699f28cf92be9fe9a8bc0
SHA512452f32b36722f115b4a3f65b15a594135488e5a2ee3b82503a4f5be2e45bc142a0d01366b0f3633b88963df05190cccb8d3565e445866f3d0a99f43c5fd85679
-
Filesize
140KB
MD5e78898379bfd75a672448d21ec2d1a5b
SHA1eeae19a5c74e59f83db69e02592e33d531ab7fcb
SHA2565ad2d9880aa9b92f35af1957276a52851aecee4e9492f142e894dea05271ceb2
SHA51241eb0a78448ff0f84440714aa7add659df344ee5175ea4cc60b6885fff3894c8258d04118e70788b1f80afe197742652aa5cb27282a1df766e86347e0ecd4745
-
Filesize
142KB
MD53458967e81af04cc8b9913f657fa916a
SHA1bbb720067d9f699c469b44623767524fa299e524
SHA25612fc1b40089508a63f7734db3428417bc574fe758ae9e2e5542cef8bf3ce7543
SHA5128c824fffad3787ded189c340deff1cac5224e856b4606601863cdc20663195e6712cb8582f4a79dbfc7ac1861e746d461c8b59ce81d2dfe79ede8b7786f529d5
-
Filesize
71KB
MD51f35b4002cb35301301b8e398ee20b86
SHA152f23bf127a085dad140567643469e1058d5c4e1
SHA2568db6ae1e4a48f1c35bbb749b4af589cf4c6bc98cea87403c036d3703937cd7bb
SHA5125551c4ab6d1474d6104e29b3c19a297f651515462c044cc7ce11c63694ca400a168c46a543df0bb470434c8a2ca47ab04a6696b837b092935385108e2e668733
-
Filesize
142KB
MD58f78ee5b48ad3c1357b1deeb663f64da
SHA14f0988dcb5dbd107ee83c5c1aa3493a741f57867
SHA2568819425b40eb90ff4016db5c3fae273f17359e6f68f85f727c513abe6b19253f
SHA5123f7437f4c6b7d913bd16676f99760e726c7fda68d30a885e3c1456b2845a77f0da77aa7fa146296d2900f064f93b1805290571605761f01b82592667dc6c37ef
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\cd6ae02f-7b68-4700-946a-e9c94e07dcae\index-dir\the-real-index
Filesize144B
MD50c9548ec30e492cebfc3db437de98fd9
SHA145ed7a40198006c215b7b79a73710bbeac3d1cd8
SHA256698f0291e7321b29b0b70342923e1a2f9d46cf86650202b3c467d5dbfa3be00c
SHA512fc3c91e484fe2141103923e12d8a2217e40e08ad3af93d21c075ac1741c3ecc9ad5ff7fe930b7ecc70788f9f49fc546b7a0f2dc61e0981bdc6f4478fe47e212f
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\cd6ae02f-7b68-4700-946a-e9c94e07dcae\index-dir\the-real-index~RFe618e35.TMP
Filesize48B
MD59c66f9b7b3da227b550d5fe3389b54f4
SHA10843104206a8c07b563fd7897b5e08fae224995c
SHA2564f1b60d5e51f49ca733580e7fe29c49cbdb25bc737ff7c2d7d794f025903dd50
SHA51279b64b520bee9c4900df64c6ad70cc2b200c82be918b696fa69d57f6a638092d1ba7a5b5c4a6e7a365b2c76b4dfb7e8a9bbee07eea25d0527e9439d3982aa3c3
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\index.txt
Filesize202B
MD5c9ac2054c83406e02d94ff2f498314a4
SHA16425c6b520966798fc7e2230a192708059ee6a92
SHA256e2234bc750792071de24b857ec54df7fd93e8a20589128b982125c52d182d817
SHA51294be29f5b884da0d853ce0311af4665cf1c88e414a5b78769a1e7536867fa11a6862c7a4ba195192c69ade235a9326b927207f10348371089905d5c671e3cb1a
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\index.txt
Filesize195B
MD5cbf44a44c7f589debf8bdf07e9be9e4a
SHA13bf0f83cde7942509f574ee8d9b18dac9dd2c771
SHA2563912e40082e8829737d9e55ea10ad475f98f5e40cccce033e6f897079bb0ab2b
SHA51235ea283ce31211ced74ad6145120490070dd5ed789a6e247f5094e7e859c8c2544f701bdf2b72b668d26761b20819532eff7bd033e05f947a9bc3ac83ae6808a
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\CacheStorage\0bf6ab7f94a21cdc9c1649f884333ec20f40a544\index.txt~RFe613c6c.TMP
Filesize142B
MD5ffecff86c046408591cea85f29900ff5
SHA19ff105d45d7d9f7022ceabf81b0b601224bb9072
SHA2564a9a73c8794943c73bcde8d3767ea91e5c3b4d7dd3c8da23e683da127ae4d275
SHA512d2c728298989486cb217f57c5dbaf5b533b8163ca773b4b34373c707b9b51ed6542f9b93bf3f06326eb6afb4b19091bbecf794c12314709b727acd50dd93452a
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Filesize37KB
MD57a9a09a734f44ec7c3ffe4ef0409f70e
SHA10f0673f2babb97088adc93f8f20b95ae1ca6b63f
SHA256674571d8a8a29ad21a33aba68d0d6ad8e35be4b44e220b889360aa3823ef9c20
SHA5129d7b2364c5b62ecfb2c72b0ce1380ace2a297fe51cd598718651829b95a8fa190f0c2de129227e92c8886bdc680f3c47e4aab6454114ecc96deb75f33b440c88
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Filesize68KB
MD55e3f68dae746a5d34a3b430c1c3f9913
SHA1bff2fad5edc4cb1293b3825519dbfeb31abd223e
SHA2564ad5b61beba427d2dded21fe68c129aa436196ecdc5c9b1296879bc734405005
SHA5126f420d0012fa0919d14b5a4268a02ab0542a404d98297a55d5be866067aca16b6362fcf900ffbd0611dd261f276497b5d0bcbf7555351dbf3bb2f6aad2e8b4bf
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD5743df987a239a04b9db667b4e02035c7
SHA1dedb8c09dffb87004c4dcaa0cc79262eabf0a499
SHA256850c5d595e41d4cec8e3588ed1f607fe06a4def0a5004a78bbf55707c910e79d
SHA512d8d5a87afbf34a4c07c4a45c27f362542e369773b3cbcca858d703617a6bb18f686cd8ebbac13c2f1d4ee60d3c2354895d8b51eb5bd4b302f24c586d91596881
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize144B
MD5140104d87f2b72610ec2952a3df1dcf5
SHA1495c2566382368bc12d7622f41aa16869be580d9
SHA2566a77483e19d6c59a669bab0c3da7583650ed23730c47fa108463580a2e43faf4
SHA512ce490fab5980c45df132c82609c78b868b2ff2ad284edf1159ada7fd8f08faf3d23e7e0b9bde941519f2b051ee7da755d872ae71544711e26bd4b2a385b8851d
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5efdf5.TMP
Filesize48B
MD5e7c3d10aee48c9c05fca05eef421537d
SHA10920da406cf7d9188b52edc1ad0c0f95f1f27ad9
SHA25613674d1d84d47835c0ee3586b0fcd33441c8fa1832ff21242261ee4106bd0aab
SHA5121960095755c64f971e43ade7e2e7b1abf45c59e12146615b3e4333b11ef55191c65d0e4711cce3cd8f91b2ccc838a7ffd642483079072c2f26e4ff1778161fe8
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\20004bde-9965-4add-b9d8-fa0c90869034.tmp
Filesize14KB
MD52955d917f4325d96716a6ed3a3faaddd
SHA1a5b0a3dc2a122ad7aba67744e023e4e1cd2d1f56
SHA256c72146e554d4d0a6dd1a8a7f44d2663a4aa87fc2026ef5bbf580420ee9971cc6
SHA51203e17469699aef14be81b008f7a8dd3eda7be5dc71804d5f3517193f4ad9dd120f123a4e751a7b899db772b3343fae5b9ff4c84a3554a22027d2b6f40c6cba29
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\7c662912-149e-4311-803f-bc7e801f40d4.tmp
Filesize13KB
MD54d71fd21eb0ac3cbf9086eda13007f18
SHA14252bf723d3f053e39e567eabecb8e47f3d5744b
SHA256a6716b4f93754c08e2b2f4bf99866d99dfa95b3bdce67a2d3b0b9faa4d22e37c
SHA512131ec2c9b4195988d9282c8c4b3c85f5be83b09f91b2fd387302f75e80efc6f9ccb2890d6333630f9679e7351db1c1b5cffb86236ab601712068bc07c93b16b8
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize461B
MD5ed2b720ee7ab0ccff3cdc67cd86b9b25
SHA163152b8cbc679d18179bffef61e18c1cdd838e7a
SHA25606558350f4fbb695fddd4c62a438191f54edc0d6081ac28132cbe33e1e6f80c3
SHA512a3f1994bf3a794557e48abe1b1eba486e866b39570d49d58f5c9156685d7875ee8debcb01e99b2c80cc518bfc9a598f54392602768e284af5b49acdf6ac98c16
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize1KB
MD582031e692a1536baa77514e0e1e4dd94
SHA17be5be139e3bc9ff6474edb6789265a9606f2a3a
SHA25643bc05604e5e3a50f6add7cd43ae022713e34cdd434c14bcb6af077a3e8b396f
SHA51286061697705e0a119db1ae9eb7ee4bea0512ac13f0d32cad86d04e6fdf11fa5d4061c459ca5ccacbdb281acae58104cc8936b066b0c2531ea6fd7c374f963656
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize6KB
MD5fd599078a7802346f3cb666fc34ddab1
SHA1852e58422d15b986f6a651669b0b9f5dded5f408
SHA256505fe8be276628f19b101c48488e8307d4defba0fcfb69caa2ae36e73a3fcd1e
SHA5128621e75c3d1e9873cb8b57e055e2712b792c10f2563eec57d8ac9b7ffb40c78340767114e64c04ef3199d9a96f5bd5ec46f2742aa0612c45b4594fb9cf4fdcab
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize6KB
MD5d6ad24928864c44f8620ba9bbbc87f5b
SHA1af745055843985fadbc9dbdf0fc37b28a37cf48a
SHA2564ff4613c8f87856b14d6b246d9dcf445f4aea85e484d3f63b8ebb7cb7cb91822
SHA512413e7f58f2cabafe6bb908a45553e2d546679bad3ac18ec18636046f4bd349f47b0599f0edfc5f8543cc0c913fa1fe02c36edacf5a7ea2aac41063e90faac403
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize6KB
MD506c0366be0888645924572d62ae59d30
SHA1ea5cccfc5b40b6c5c6b2f0dabed95dff611701a7
SHA256ad5a0ae62ad94c2fd6c2ae4849a39c61c99db777a512313fff3298eebdeab708
SHA512ba1b90b3cd9fe48fbc8a9467f5aa9fd237c315c58165d6144fef4fd11d1bf802bb000b1a194fe7eda4dbb983db03aeb47e50408d0d60bab754bca28c4cf2ea67
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize7KB
MD5cd4a8b8f4349ced35d032fe5397a05e6
SHA1b412c3ff54520f42772d5486f52ca95b84d61784
SHA2562ea0beaf321d7c4e73b5f7e0411c924104b2323dc157182e9cddf77f8f5632c3
SHA512310973c222317b3a13fa19f9396e2b3797ac9a83dd8834bed5389c0bc5794c76f3c0f86fe2bf500e55a40afe9f123e5328b3d27007c4039c286f6264e1fb5391
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize7KB
MD58922ea4ffcc135365cbf87480e64f2ff
SHA1120400e4e868f2641ee8f8ab9f40c02c43397d2c
SHA256f8b51137d72421fe806be9822355c8c075e30a7706408a325560189414cb70be
SHA512c08e2ce47c6fb2a03a021c05fcc1ed5a65e91578811e1248452e713555e28199e4f93e22a6cfafc1ff175371d02ece2bd6a0b7762b1cd12f92bc98c6432ff313
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize7KB
MD5b0fb78c9a0b54baf5e158b659c21f239
SHA166e3c90ec52f520932a2e8dfd7f1cb4579aa6614
SHA256b8db8486509b3d51ad90da95f218819a494980c6aece1dcc851c5f37882e5db6
SHA512e783500ee9bda48afd6c31b00a4b0f9adeec11c2fdc6c7b9e5a1f2ff09a4254a415abeb7aaf22012f1326894c4caf2ce81a00eb1a728412fdae9ddc80e135f59
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize11KB
MD58220e81aab8618ee22061ca339dc3ef5
SHA10d77546e02b5c71ec054b2b9d046918ba5de31ed
SHA256409372c08601df6696a1fd5e7b314e33417dcd7d05cb502df1d75f0459bdd4cb
SHA5123a9d9bdad03e69cceddab39fdde920dce6c2dfacf5b8e086f17c4a20d1b05805abffea8a68794de7eaeacf7829b3433462192b707c114dcd8c25585c2737ce2e
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize12KB
MD586efa6e9477762316f733e61867e9af5
SHA146e5911a63373dc98a3cf530962751a10d29f96e
SHA2567ca758078f53d2c34534370cd2898fa456fb8c11a408ec1c3264f70192bc1549
SHA512c55445e98cd20c5f632ccf504ec6e0924d2b7899be3eebe0cb71c591cc47302c9633ee281fa39ebe7ca12767d3705bdf1507b8d8f0990a9be49287b434c8af42
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize13KB
MD58646929155f459b6c676619196dd3cee
SHA1c11995a41bce6d9feff6b271d0b00a7a295961a6
SHA2566a44f8680e2d3dbcf280bfe3138ae57e995ae8dd5fafc148de82d2431fef5a22
SHA512b74cc058589653973fa596e935ef58df18a2384aa84d8c7def4e7f9a6eb713a9c89741de7c484290837f77c9ead68021f9dec7856f3f94bb62e86056cc7f8c74
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize13KB
MD585a80b2d65aed759a1b4dd268651c115
SHA1f735a55fdcd75ceae94a67b72a6da7e01729b6da
SHA25699dbeee5097e6997563b4a288ecdf2c3143fc2b6064f264bab0958ec1402c157
SHA512884b7c1a102e6de6bc16247e2b63cc1ed98d68694eace9974f6583135c09565368713436b824091b017b94874b717c18c3e8f4819569ad57e33374558a4ab6e1
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize13KB
MD5b0712acf1ab6fa8d0453ce1269d73079
SHA1dbc8a1bf51b6fce536764eca9e30791c122ae91f
SHA256f7c9d14249e08db049a6bff3da5d2b9869c407e928fc1a340d957f461b53974d
SHA5126586078768b1079b4004f1d55984c968ea88c91d3957f355d26aa17853db77912d124c78d0a4a9b1c15bb161faf392a1d545c59ec0ba32fdd22595036f955eac
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize15KB
MD535eb23dfeb7743e198b2c0413bcb2bd1
SHA1c10b98a876a03da73871768507c52e2b84774844
SHA2566f77bc8821122ab44dc440ab972d20c05dde494e2482f02ab20daabb4e7228f3
SHA512bcabbd9bf6cd5884779827a5b7e6627fccedebd06f13ab2db867cc3067e94132671a4e453ded4245101f5dd5a2ed0e2f2f9b49cc61332ac148b39a8c6b225098
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize15KB
MD53ea273c3916cdb57e68635c6bd990e4b
SHA1c77e1abb619c0c1c69cc891797ca95343b783df4
SHA256c47aad931f1de2d709cbffc47da557bb7a4be592c4bcfc7892fe277c972cb1c9
SHA512cce0be8bced81584999bb2c697b21f1a161f23eaba9b6fca2e9f7200f66a7d1634285f2007a248b9f6c4b91608efb949464bdbe36b2b39c0528ab216a0661aa2
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize15KB
MD59b74fae42f9301c09010df08efb36555
SHA10c1cef07d47725beaa5257faa466e7b67334367f
SHA2569db61886f1748ea42f1446e5193643bc96c1054ed17dcd3b5470df5797fffc20
SHA51230b8b4e45957ef7843dca2762f59568ebdacdf0e2d16c90fa437b8fde86aa71278f0e0de9367538d229af9948f555ca05bd08cc8c9c73cf65dd21a1d305154be
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize15KB
MD56a211daf2c4962201e91578797899ed0
SHA1ca442d204db2e7f62fae37fef695dd344381ed14
SHA256c7b560f5968e9704cfd4d41656310f1a00933857d60952b87567f30953dd0001
SHA512fadf1d0fd407f7ce85e57e11112aed550e94650883bb7ab81408eba8e2b665d4ea671f6113ae0ec2a3f83c787ab53f4b06f7586d86521d6cb902de966893266c
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize16KB
MD549a99f30f9999817c91d179a18cba91f
SHA16f4a453534f792bc6df1c486424aecd664050c9b
SHA256f94b779ddb93e21eb884f4a1f6693123d7c7fffaca5941f1fa868ec76e000d89
SHA512ff5375fbb42afff971c8ad55b1137f4740934445fd7173453b9cf36d4fea08286fff0672bd702ad7b9c1fa0d6fdf3ffc0a079f9d328901169d805cd2552dc127
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize16KB
MD58badfddc145575eafb649ad6a3ff5328
SHA1b22eded489ff2b1c16f3c6c329dd38402a66657e
SHA25624e2cd490fc77932ce407e59c574008d26a2ce5c1955e7d18f216182ab9a214b
SHA512234b8950b2d199cf4617cf6e2aa7d73265ea605c6ec2d40dd4fd00930452a3ef3b0230263c3fe92b53ae217d1e6a3eed52bb10af4825100f54d8f976123d11ff
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize17KB
MD5c6ec6f16e37ae2ab7b8813d732df4d55
SHA125ad7289683348657be03d7f52d3ee5410aed910
SHA256d932497090fd4a5eba89c5d470fa953eb3d44dace703f80bf9862a81a04f3a64
SHA5129ed443bb1769547929c5e25beb5a4efcca3a7047541cb2230afc77cdd7cb56998d8222161369ec69fb872ff3f65b74f3329e8bb8d8173e51e8d71757706310da
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize17KB
MD55bebae85c95653b687f97befd7a6476a
SHA143c6a88a75b987de7de9e423a23e7a5f0a81f5b2
SHA25645c3109cb67a86a7a343824452630cba1d84147b2559d603f51a3984b346ea80
SHA512a91ae33295618af49ef233c0bae346b6700ba2460f5b4970871e165c5e5661714f3ad07c893ba8e209b65f2b75d69cc037fcbfeb0d5b28a249662bd7a1e63bef
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize18KB
MD5a1cded672f719bf6fc2121f9e827c750
SHA112a8ba030a7e5bbe5de16ee3a3195abeb07bed2a
SHA256ef5ced9f66eb64e28698b2e1b0c4d46444ea7a2a00d04826bda33d2852f6cab6
SHA512888ae3226fb7cdac8157a2b3534c8801023679614ff7aa165a517da28f5b4e3eac4210838a153eeb77c282c143f95e31da576117047e403d1773591c52efb982
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize18KB
MD5dd147ad604ba5791482fb0c175a040d4
SHA175c013931ab924b5cd96f6144caa49f5ef3ac633
SHA25658e435d0496b367cbd5db62047a18e0245073137c64e0bce0a58d3c586448b20
SHA5121c4b0e0e0c73f2f38d23c2f176d629dad247b601a2a36336a6e5e40e4143560f58ce0d8bd4d149055454b70f61d7b6d81c71bec1bbc44a56796fa8a71a727308
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize18KB
MD543276c57452f54c148f84d8dc546110c
SHA19a34232533b6664f43371c6b38e838dea0b9a03b
SHA2563aa02f9b816f5feb53f53df60ae83892bb0881ec7e8a5e025e5f2f7e0b72ad34
SHA51263d795a0efab35bfac6a7d3876448ed9e2fea54da84ebc727b4403a8aa9545a434a97a62d6e50010b8a38dc7045e43721dd988b0b76ad6790ca77d83d915ac7b
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize18KB
MD5c6c6bb8b553975011edc2dc77cf6578e
SHA1672fe6d999e03e2b2896b80e9818feb9f693ac42
SHA2563859e22e783b277315c81c4bea4f6739593a58e188b83e10d8567f4ba4a42f71
SHA512f57583f088b34f9bd986fd6fb3fea678f4535cbec3a23424d0da15c0dbf84f00a197fcd02bea8d9e36d828badc6f16430bfd8708f36fd5fc0ebdbaaa13e1ee74
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize19KB
MD572aba15c3f618c5cb398efec311838ee
SHA148d274dcdec7e021af88e56b4909a3aa567047e8
SHA256b7565038296bf9566f993df120b3c88c7d828d7ccace1572134536e9af2b348c
SHA51213adf1016c7cbe330253a119b3a07214e489cd062c68a659be7923a46617f616b05e9ed2370125da22fe327436b02be3b1e5db1480d3bb4871dc5e0e8f0d56ea
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize19KB
MD5e94247f3b076529749dc8f50b6a4f431
SHA1de2dc14d2149d1021e01dfff64460b1560333493
SHA2563676ab796f49559445007074ff1f29aaa09ed25a354e7a6f143532f5acd222cc
SHA51266315d39124bee644130d8f683f2682625c2d300902bcacf77cf5ed2923e1792e23bc2653444ed1150e13c97d859e64ba5eb2c2f92fb06af0710789f35a2ecba
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize19KB
MD52e4e0a1d0d7b2e1a120626a456702f09
SHA1a8aa0d1153099614641e24ff7b425aedc0796dbc
SHA256a56547a7a722a6a5c2887828b5e7c358ae024e71b36c24ac722c0ab96bacbe9e
SHA51249450cfb646248fad84b2810ccb9678c18c572a9068744d25b65bad292556d2ce1f955173464be6b6628be40c55683f5623b8a19136688b0b463a67c6c10c13c
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize20KB
MD5fb3cf22439a0e6650a89d9a76a00370f
SHA1a1d6d335783442c1b357e2480f6f6629a8508b5e
SHA2566fa10c7f66e40eadea71f039d91a0b8ff953033f4a5c091f69306ccfef66b155
SHA512ea8f05be3f1db080cd82807b4a9384f28dbee83af8c01201848b443c5b61665f9c4ef235f7ba73fc86d8f2f55ab67d57c44e48c707f6fe012f7ae6791822518f
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize6KB
MD5f8958887def25728f3cf5a372504332c
SHA16ce1914a8afb62acfbe8900f2c382dc7b3a05423
SHA2563e49cccc2510713551376602b5904ef1cd69576f8c387356cc9fcdee7492651f
SHA512c0348460bed2f56bdbf6a43e4b6de065ec301dd59732584571c1a6696ea12b4778133221b5b62f8e545e6a1157fc284a9f156937e4ede862a65bcd2c2d6f0ed8
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize573B
MD558e96288633c52db0ccc7801b5c484a7
SHA1272ac3e02f7ad7ecc72210b33b2948df0b266a9d
SHA256a86ae9f2df5cc1f55fe7ef6a27586cfe28e33b7b79b33f8b46f688a4698657da
SHA51243232be4570e29d33bd370bc1ee7dde9fb7161fea71681db42f7c3ab863f487d85305f9cbd6f1dd842b958c97481659407a3aff8ef95568843a8599d166cc963
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize797B
MD54be1dea0fa1de880fda63cb209b30f42
SHA1e49cd8b21f60c3372ee27dce1f1127b5912422dc
SHA256214d981c36b93b63c86f3ab0fc0d520d259676c1f12abe3808ed009482f565f4
SHA512b6209e9016b6b349e5d81fb1e4fb3bfc26edcbaf9074e88c41bd68c73cad2484fa0b7b4d6d89f1b0661815b6ab96a5bffdd6c92033e5189e66ab650cbd6e29eb
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize909B
MD52cf395f95d350ed998c2f9a0a67970dc
SHA1875ed0bd69ee2ba1890b3ed5bcf1a19c07bf56f0
SHA256fc7edb85c0c214b6f50ff3e6cdb7fb5398789fb219b300358f61c45b7266cba9
SHA51267dfaadc203a532a7dcfa3e6b69da86fa74fce19ca21342c6336ddc8ec59373a427ca8cc62ce4552ae02260f4c4fed1ae1dcbbeec3e74a14a63640b4297bfb40
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize941B
MD5db732d43f5f505b53b263a8f8e301f44
SHA18df8b7ec29cfb87915b3989003786b6f79c19525
SHA2565538d3d657c5dd073f564f7f19790db997f3d8c89f51f2d7d845c040d96b42fc
SHA512afad66d98dbd54d00605c7f5502984cc7db2265b4721af684af06c6449148158abfe63d3541eb3ad7d5f0baabd51ce168d0e7606cca71a56792d88773aa5e950
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize989B
MD535fb69666e5d2d364c9b0058927c0356
SHA15c9d835765e174b043c1c599cc414c6e33dfee2d
SHA256b2ccd170f172dec9ea3f57b2f4341f149241802b3f355cd743a99a181d308fa3
SHA512e1b6a419144d6385c93d2237a1ee7df55538d5cf7eb1a9a1a69e8360008873673a201fb7f5cacc54958b007d7a049162857f7539403df1d057332f91da416c64
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize1KB
MD5006771eb7d485ba4654f1594be48a591
SHA16725f073d2acb0990e18ee3c54597c5968eae875
SHA256d31d65ba7cef0b02c8e5715b4fd559cdb5f078f0bfcd9b2b295ea304433ac59a
SHA5121705fbaf5ec699bbb17f4607625fe36c6c23067b37809057c1ed56ed478f592b3dce43b2d2670ad47c5750cecfc1b16d307cc81e43df2cc85b3a73c7226700f6
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize1KB
MD51f50d49ca4cc5049960c64a1d9eb9f37
SHA19257ec91562bf1955e245cd9982feaff44e92c45
SHA2568a0e6ce112b9d959f793c579e207c0e4062fa4021a59cc063d00268811f4be67
SHA5123033b62d37c5f9f730f75787de7a5536e49cab9bac4adc5d2886dbb5e6caf419873879ae0c98e6119cea34a88a431892c8f74a0ae5d2bc4227074c592d251243
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize11KB
MD57bfcaa4e6ec3becbe2bd740c49f9ef8e
SHA17a6c56641f441139ec76eae20374217ab8d8bf03
SHA256a1926537f794bf5600f2e314eabc06f4f4dfea2bb81c136cf02abd03f126cf8b
SHA512ad0b9316be0692a6ddcf848126887c26b27c7dc997a5ee27341247dfce7e0ee501c310520a2ca4a84cfc22e44bc39e88f5c8a8b0403e707da131be35039b5791
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize5KB
MD57a965362d95c5d9a96d764a95ad1660c
SHA18950692d47230fd5d9847c57095f27b1d9c3e6fe
SHA256afb750d23c7298ec0d629d6b71c0038f33eb3afe6b7c04bf19aff9c406d71457
SHA512444e710d7959292913fc513ab3a4be9a96ebb81bb697a205b56c2f34b1e695c2229ff1bf123e0e20bca0d0df6aa86748ed14df72fb5821a9de392c5916f5c995
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize1KB
MD5f71dbdc6d57ccb64d5c5df624d9abcea
SHA1414d9671be763a56f7a514cbcde1d26ed1ad0bdd
SHA2562339922519d0fead0f76b41ee51733b002ecc41c5342780271eec3974436c394
SHA512998251e1e7defef768a221d4123fd5d0000aac8e0fbd372112185362b232c8b240d9256204e11a4dfcf15f10fc0cf9a7e47d91b80a71e66081df17197754f0c6
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize1KB
MD5a0935e33401a0fa28866abb716a34670
SHA12111237e38a866a9a5eb2ba3134082fc5f60de0e
SHA2560df811db0406a63cd389eeb08bb5e3868349cf801c904dc1ca60d8b951f1dcb0
SHA5125d41b1b08a110ff987e6507fe98d5cf464dfbcd7acad8ee2d95a7b40a0de68a397c3b77a0414771b4005f3177fa741757068e7ce491d4e44162835a8dab8b12b
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize4KB
MD5c2d0babea2ec9e011980e38ae4a68b51
SHA181f96b89d49b6f5f04e47484368e064cbd8c6f10
SHA2561740a8b804cce1088ad983c9943a31f20c96d4a4619a5746f2fc52ba77659560
SHA5122234b381c6d249cd7f0553180a6712db38cf1ab7cd94a7b9b51699de426b2a6efb3d13ed4d946511e008dc2b48f3791f604c913680722350d9aa02552e2900d9
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize4KB
MD5710fe5ed2f6998dd88d0d6c93e45c950
SHA1ed405b1cad23456d4233b07d84e14f6ec1cd2a25
SHA256754ea4c55dcd5b1b507bd34dca19dfe3c9cf4abb499ad0373be3499bbeaeab25
SHA512b763a93c9634645bc2f5ef3e1958984faa04472584e520452864fec38438ab57b1b7824dd4a6472d4c91eb7fe54a1aa1fa6fe84d7eb224d2d9f01ae4aaae31e2
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize4KB
MD564d8951b4eac52c6402d828bbc3b2bb2
SHA11dc02b5d0492389a3967fad5e07c267f405f0577
SHA256ccb0b3733ec3d342ab5b12bdbf88264687caeabc2e9426dbcdcfc0bb14426f0e
SHA512f864ac5a6bac999cccd4c67f002ee01ab4b4d43f7399577e87096968a0d36dc9a3ea5d4bd99a0da1184f3c5ddf2e3cfb657849528f4092c1cbcec8659fe0c3f8
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize4KB
MD5adf3d0c87b1a82a70e4e6be45bd5afd3
SHA183e5b6119b1fff1dc3b67e9feeadcc4f55bd9561
SHA25661bf10c8a65b607aa8747c443c98e814aacb81d8af91ef572dae2b0345e5cb67
SHA512ae9bb8d02b6c1475adfeb2efdddcb8f031991855a6b8e19fd4eddb0d1bad8ec22e1723ad8cba1d1be41035101d4330417ad7101fc0e9121dee0e114b31e16daa
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize5KB
MD507c2ebd856b61e5697b5a6bd0328f4c2
SHA16a4ab1594038d7f4fde18aa662cf6c345ef3e0b0
SHA25637ba6453da3ba6781faf4419a299a7a2322b8bfdab4cfc08a52827f11369c153
SHA512c556a47f11334eada79081c38f31f838bf34abc812087b2e1c51a0aeb01b141c003fb530717f2bb3b86f175da8ca86e4b1ac27758268706720dfd91f801f7812
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize7KB
MD5d576d0e7aebaccdc6e62ff9157cad82f
SHA1c8ff7e08d0c0d0025ec33c897e93b9587ebf14b2
SHA2564d48860dca252bd34863d8129c7c88b6f41fe952465e7d7c67a2ef85af4f7b12
SHA5121128a80598068aef9f6af73e4c5af08f094949a5c2449f80423251894fc624bd937d40296a14e5c73dd5da55dee02f42f789b0eaeeac1eab812f33228d766080
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize7KB
MD52a9bc18249be16c0494dbe1913166729
SHA1dc03643f940781c92f0885ad18dce5e96a5445e2
SHA2564b4879862b40d1ad10241ce52fe5ad72bd7b7a8ea1abb26afb5c3ee0c49c9376
SHA512a03de40c0c5fc308189721a556f81d22b309ca1e75adf2b6eabeb508406ea63b58caf1fbaf945204093df76a274d2a865e91781bc2b7f348942ae553a1f762cd
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize8KB
MD5c1ed6c695b1e5fb62c7252bd10b592f1
SHA14978df62b94a63b87328b136c78ede28d9cb9e0c
SHA25611012df0398247b7bbce478501afee9444b6ffdb912ac0183e39f1cd2c5894c4
SHA51222e096917ccdc17d8a8d00cb3d735eb21fb0fecfed1cf1188824eb4352a8ef10de371d78c5f06a8031345f0c72866c8518362fcd6710a62686723e0aff13e26d
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize8KB
MD561f6674a2bf464be9a249c46b546de9f
SHA1a190f0458c5a565fd8fb134a9f51027a2c050975
SHA256baa8cae5f1f0d58e3e24160c0e4819a63590fd1a91d5ae48519199d4d0d9fc56
SHA5128a8f7d89263d7a6d70828e828129ec8997c1410924f1436766ee817d76c292ca68b894d396b7a70fea6586a10ff6782fdf9ad3ffcf6bfd4f6850df3623071462
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize8KB
MD5d50598c39aa06d855130f10c06585142
SHA1579abf4b855a40565a9797842431df19f3ca7a42
SHA25689e4c4a32b40189edfaca7ecc685cf46d8626a9659595beba074edba2891be2f
SHA5124331c08b9db1781c81ac2e00c8c1eaf65e11f1e11350fd0b93507a0d1592df2f32c1579a86684b4b8d65a943ea6277fced717bf2652aab5f20fa85fdd4779e37
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize8KB
MD5c2576fb658480dedfbe1ec474e82c76d
SHA14f427285fa9413d4313779bc37fe19d570ad3438
SHA25617026c6f95a1d6b7683deeddb7b29ee4ab9655db1dd1aecacee808c222cfd541
SHA5124b5b661ea822952d612f86300b668f2d2b87c0b46d29b9ebf6f9233ce6f44e159dd00b0509dfe62e3fef933226d782740e251456b6e21a3ec310955d7d16eee4
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize9KB
MD5681b77c19c95dbcf64d3cfe5428a48d2
SHA1212aa7d007961c83bb2f2cd09beccf445d247db4
SHA256c0cffb0f6fcc0a746c65051cbe23a5f1db7de6ca88470b62a0be16e4fa7eb8ef
SHA512b5b30a9f3b9a098a2c6dd13339c9ee5dc408a801c17719b2ab77b10015b6f9128174aeb028a5af758240fc33488de734979ed83f55e9f45af86545f9818a27fe
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize9KB
MD5994ea8fc590278c6b061d8d5bbf03948
SHA181ba724cf6aa06f34a2ae9886b1b6de5ddf019d3
SHA256648ce48f5151b1d36b912b31bb7eb220d085bcffa6112280819ff9447965ca62
SHA512618c0d17f373033f97214fe2f3b9fd712bffc341c92683e6c52f6cf4e4461213cbf5277cf805b1b84c2366b9b8d1db4fb7d744dacb9dabea38e221a254795f23
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize11KB
MD5cd594b163326dd7a3d1f7923535a6e07
SHA1ace8dd75e94c8ceae36a6210e3c8e44f4d31508c
SHA2562d51fc6f79b1be85bcd1c042f986138dc471c2f95d3f03e8a4f667bb3321ab05
SHA51281e97cb82a1bea892fb1e7770c462b973335e016a5bf93c1c46891be26e85cad76f836b7bcaebd429b3dacbaaf224131945cc6ab29e2025b3971383fec1d26c6
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize11KB
MD57236d847b3d32a7a076eca035b221946
SHA1e3d28f2370de51322fdd93e31c0645feb6a016c4
SHA256c7373381c26c2ef04d4fd9a8f991f4d886783771dd17bcd3ff3e649606ec1f5f
SHA512d42a76eeda627280364ba6ab9654086b46ecf8fabd1de2f852532ec0954aca6e9fae32f17c770ea7ff04c901f3f100fc507f70d7e53e46d680aba2f8db460f49
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize13KB
MD56a06bc5fa494263b7da44e48bbf33ed3
SHA1e03b0766887e3d410478911af871e329881fd846
SHA256788c798f14c5e54ace564c118e7561934df90eb271a10f20d83ced6682d86b79
SHA5124c326adba9b2d5035ddfb94c4c0559ab385ec468762c584df394246a2faf1fbc0b14733feb578b14ab19cdf5c13ac69c2b97566f2c9284058e3a62626a70ee7d
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize13KB
MD5e1a9046c5e02c9beaa8e47b314075f50
SHA17033c7edc76eb87209e8488c32c0078142b0f05f
SHA2568f15ceb06f27a37655f66de2331a541f80a3e7a3ffdf4f901e56a4934dec71b0
SHA51267fd543e9c67f238037490bb4f36d1730823c9a32aa0dafc961dca6754257a6b2417a45742125f32de0ac66316f1ee718d939bcd42d766c79e3d5afc11493b9b
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize13KB
MD54f739e248b59cec6f5daec6a27e96ace
SHA16e2e9b26e772194ad329b1fb26f82e64f62057ae
SHA256012521a3cd2dc0c455e1a99a6da734186fd2cb3d6baa32c205fcaab3a90ce1f2
SHA512e02a0a89f9e66a1dc0d36c6443aedb43c14880f8b6d70f5c5165f50b7a2cf038115171605c3cd8ed318faee24654ed18f486841703ed3189e42c5cf7cba55318
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize13KB
MD574bdc7e10394c954f10157192fd53c5d
SHA154a95b23d2629dfd6e4883f6fb5c8e64d675144a
SHA256b0daa330888e4f77e3a79d53a8ee07bc9a2c39f7e536eefbe341d261a674cc23
SHA5128108e02f88da105fe1ac6b50dd30fb827a33b1412ee8348bf6821356dfb9a455d4cfb04a42e3d68aea2f10ddc0d3203ef65c037cffea4171f1e308483dabd987
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize13KB
MD5baebf482d13dc469ad21cfa28e29a3fa
SHA12eca4d0d8ef3614e01ee4e1f2341fe1ca4785288
SHA25608c7f747f8952eede36a0b57539e15aedeb55b171f655a8d840096b8ef567578
SHA512a17585b45e41d79fb0a2e97f8d75398f7216049c5b1634b7559860b87d9e0626e989470401597ff4a9ee884b082b424a113472c051a5a73aec10f62bbfc8913f
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize15KB
MD565fffa15e488524d6f99ba191b5c868a
SHA18d89bad7760d82171c326e580166ea7289abb292
SHA256b84e05f8d1555376b7ec0493d674f2829147cebedb958745482bf2ab2968aad3
SHA5123edf31112039edfafca898f3b783560f7268762a8e1c54b12db49f933bfaa15bdc76a037cf65a9f5055d7cb4c3b4d0a2f90be55a3e75b0cb07c943450a4b8b30
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize15KB
MD539b6959d57f09e862d5510cdafde9699
SHA1c46d1e8168a8d5bb9eb9ccc17e0720e695755fa4
SHA2562d7b24cd86cf0c67cbe8ab19980c667ceb506292e675141d9b25db0281fb8e3d
SHA5129ceca9629dcf22b619593f29257232376949dfca65e5a6b0f1e317db7829e148433035c6994d8e69a8962ec15f33d1bf31bb65bdc0d95a38ed3982717bae5557
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize15KB
MD5ca87e05099082387a62291f8857c466c
SHA103d2173cc931fe6cbbfc30826b3a16490b1b03f2
SHA25631672b0ef603bbdd2ecfb09ae1a9ed89753cecdd46321feb556fa5c72647720b
SHA512b27f02c1d81c174a98c6817438599e756104e42a3a63ab4d9d2bd80b6745e99e3a21a6a011b096c7e1a9d1bc253941dda93681bfdfa0e6d16e29b9ad3cc2ab47
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize15KB
MD5198fe81b2b656a211af84bfb3cbce006
SHA199dd6322e380884b5216a0c0e28a4c8437fb8ba7
SHA25624f36e07d8492d00e281c5c07c4cb941f67a61afb03c5e264897df15cbd2a948
SHA51200c030c7a7fe890b20e2addb40fdb8c9a5bacba9964f6cf2d59c989ad3256a3ef9b06e496a20875d6e304de1b27a90a9aee75813e1b03d761d5277a1e6fcb263
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize16KB
MD57a8fabf38675823fe38e3dce0d7bd1a3
SHA18daf1d3f791d53a3a71900153f77776f971ee04b
SHA2561bdcdbb521039de9d0159c6ed9acaafc5956cfc2c2d04b911cd15ff87ba7680f
SHA5121145cc6b9005ee32d24ca83c317bd3074f5808e43c224ddced7a7839c7e73460ea1155cca0e77e29f09756c6909073b1a3930d1f96de5a115f2f9edfed173642
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize18KB
MD5693e2bf01ddbcf3d4d72b4119d79064f
SHA12d2a6c8053d78ba6d52b260fb467041368ac80d6
SHA2569885e0c5316aecde304ef6ac68cbfc2db44ae57705d7aa23a8d61e73bc040407
SHA512292831a4de3851c9baba9bc627638a79c17f5e62402a9dc6f4a1b41a1907d6f27627554a7d6f3d8bcf7b3c4e76f22e443c953a067f664b373ae3a5491e29cae0
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize18KB
MD5ad08c60d256563366dee9bee64ae0d75
SHA1dc677786c476825bf0d8e90ff9fd3660088988bc
SHA25653e1c210fa92cc3fb817ade78a62e85fd4f58db17eebe875912f0f86f7d82187
SHA51256d5d54bec43fa51488c287747812af8687d7e0a440ee83e8bdbe74e6b5f44b729e3c6705c856ac6229dce7123e81257f7374fafe101bf384b9892fb8dd87438
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize19KB
MD5ab3872f16ea72788a0718c700e81b1a6
SHA120af4c262180286fe71e70ea7ae75bab3395092a
SHA2569dd91c84aa9c6834e76bbc5a2e9c8f9f5b1c5baa22452ee1c5b692297938408d
SHA512e1d89af84647952d6c5cdfd6a743dd356e2293e825725f4d593935659b61adb56289b1cfc3404c6fdf5db5bad956423b7563cbec5b41bb8df882ae9b4f4a55c6
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize19KB
MD5c1244b4c8fb72d98a547fcbfdd3ff6bf
SHA10b82506d6eba59f70733e4d0b8ef4b27147f5c3a
SHA256bda24eee8cf1665fd19bf5a4030e42f4c12b638257fc82561ebae03e13bbce16
SHA5120a22d2a5b36203d567fb87d82c4af3fa89bc872e671cbbe8530c643949c2c535bc4d9fa96cc625f4172a916a60d7186bedb2cf2db4814ec48270d57423e50869
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize5KB
MD563de65870bcd41511f06a94b8a6f1de0
SHA1132426aa70995d34fe21d3f98f82c14fc96c7e81
SHA2563068f624ed818e5d0f1bfde79b343905f348b827b09e2748b04b83b7cd5346f4
SHA512010e186fa0bca1dde717e09f7eb578f46bc6b6d55f9693d1c9ca6d51fd1b04ae3c380d600ac6e91ab4da54e21382afaa4ca4f8d9c07a0a374b4ef13e6dbf4af8
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize669B
MD560c30fb6a67eb77c8eaea3012dba6ca9
SHA1314c9e982975b9e61d22793bfcd860531b6c0129
SHA2568ab6267e231c9cbd3a358c05235847461e56ba8cd91c935eb15b134ce8972c80
SHA5128f2a7e1239bee5311698724d10fa3d4a39673ab48fb89d3ee59c7a37851ead36ffa2e0a54a351e764ec3c73e174fec75e10d04273d98967ec02b9e21a5e0eb01
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize6KB
MD555ba2b610cc24c7ea9f639213d40e4ed
SHA14fba7123aeaa4569d4f24af97d11f74c9309ef61
SHA256cbce47372a4958e7b9fdf1280f8b7525f2714a72201a6df74c103b11c50ae966
SHA51253b1368a908794e56525390447ae8856eea0976f73483b9f7ecbc11a7c05ffe87aa42161f1ca1d3352afeee3d8e9dc1d309bc4f668622d6b3e1f9e8bdbe348b9
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize6KB
MD5c718ad15462f4843e77a1f7ca5dd38bd
SHA17232827b2891bc6aca8730a65d88d2c4b0865b34
SHA256426e425e8e19cc65e1106e9f9618b48ceb73626709fac0134471e484ab686b30
SHA512a3e5e260b3c0a966bb98cf3694e2c142e3f1247cef67ccb3b7f4c52aa68fd0b7666d665355970db5886ae8dff01a4b29a9b5c934b6a70ebace97d41031cc9658
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize7KB
MD5acfeab18f1e391f18496c04a407a9710
SHA10d59ee0e99fea5354c1cf16efeec2b1b1e488319
SHA256376d57122f1806fd08b63d2f82ff71d296a873290653bea99344efe7eddc158c
SHA512276c5ac1ef03ad867e5cf1b1b348333c261f9a1168b380e764eb90d61352c58d5dd6b35276781b58c6055fcaacb019cf382e9d92d850542269b7027018f45f4f
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize7KB
MD572df02dd0160f6ad251d3171a3b0ab6d
SHA1a73aff647934583b997c3e6afff78d8098b8de4e
SHA256335bb653ec2b267ca2b128d1ab20dae67d240fe1a6cc3dcbad0e2faf8827a7e3
SHA512ad67a1fd8199e80545d76d9f3f0bdf7726677b602f4acbea387ce1bcac6a18837d4fa9431f5f597d0f33ab144083e1a8db88002d07d107179df8e1d67a20c417
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize7KB
MD5269782313aa18d415d10214efb799052
SHA15c81cb211a87e42cc8fb21d913010d4928653da2
SHA2566d3b4dd3d9a03248c338b6e88d157ba6279ad0f6c0c4a64401a18c22279ad922
SHA512485d3503682b1c46688b5637ca6e9e8d8f860de2841ded75d22032896a7546dbe138cc75f3422ae4e01e0d3c7290fe2165a204a2fe8e1a4db5786d52ced02def
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize9KB
MD53136b762cb41a4a9cc03fcf1e6eced8b
SHA1f3bcd71d51ff0b0f17283f5b4d39cab2dd46e717
SHA256810966cb3137625b2102abcd72f968eed9fc3969a7f85f793e94910282092314
SHA512951ab88f93b91826019c0192f29fd40ba05db33ecdd68d56892d81dba12117767f2c34e8f4fa74cfe034cd33114ed8ef4258f1f26c9219e6ebf9264ea3b98500
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize8KB
MD516fb74fc3e8bb07ed8476e79654cd82f
SHA1f7ae74505f2965b48ac391553a1478074c955fb0
SHA2566ebb0baf847438593b33513ca81cbb36aab443618dd532199c1ee32e8161ef09
SHA5128b0e9905a76f0d4b63ae4667c1f279826012dcb93a1c0542134962103045833e870636495fa3aa02221fe278774386803983599f55c10014c4d4c5bcdaea0d78
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize8KB
MD5e26e1d1541d53a5d99406e1bef1c7005
SHA1ad73cd3872d3dc5a05391996646fc75c2cbd53e5
SHA256cddd430de1a3aee56a32bf57b1ef6caad070b4b559a635bfdf7d5f29d13e2734
SHA512da27032517cf4903d99b0a4589659053cb009e623f40f8d2d8e3ccd2e10b26e3d0bc723e0b5a005895f5c41c005f1f195adeb3a38e0a2339319e4a3903870678
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize8KB
MD55d389ef43c8231db070a047f13e97c9b
SHA1f321cebcb086a90d98141d8a5e98a9213ec9de20
SHA256b1685a41e525015efcd9ebe8dd4b769da25b02dc1fc37fabf5dd87393adf9294
SHA5125f88b43c3101812781584e2b1377faadbd437de57fddc6fa398076cde5eeb3e4bc6a4f87ca00481b895953da58bb6d06949735c925a42c3fd76531c1519539b0
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize10KB
MD5e1e3a3b59bb920b864c9e6005fe689e8
SHA17b396398c709c243366f808614a3d0f87f11cf22
SHA25691e2080821d234849753e54afbcc490702d03530404f6aa1e2272d0747cd82f7
SHA51255f96e024247f4f5efbb20ae74f346af364591dd5b5d8a7fcac48aed8d169acfc2a93b2e204b381c07f9863a278071ca4c35f8c6d3817d4b0c92150f3302be9f
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize10KB
MD546aaf229f19a8435c273748db1432371
SHA1b4199a17e1f1fb7913d640396a3db3d2f5766364
SHA256df278e95839187df72fa60d162cb5a1ec8fa16393431a7a59f76842e889a7ac0
SHA5121f00e2bca9a8b2519d038e887ce8aa5703582201e947991c7b9ec15aec3f9288dab69c3aac6702a6f6a58d7369dbc49c6f470cdc3c0db21a3056020dd98f53ce
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize11KB
MD5fa5590eeb2f2d04c745a75a2567ba617
SHA1b70b8b93321b2f8b9633576bd7d1bec219c7f849
SHA256fb39bd56b2031cbf3243c703d3360f20d4ce7db371177b9eb9b81fbf7da88c47
SHA512734921d04e5be6906100d691a35ecbbba471c880c01b50a326f0685626f1901fae010725f70b169cb795e925bf43c55b6c1698ec7be68ed7fd5dcfc496249fc1
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize11KB
MD5c426698e31ca95e07f827596bacb7389
SHA1da61ef0ee30612c8560b84229b303f128f8d78ba
SHA2569dcd40ba9ef6c1ae8bd1599492d4380461e6856b539069ca1a2ae2ff7e006d26
SHA512abc778de77916628ef4ad0e609ce7abde9a0778c991d4cc62ee896bf6ff3fc2cdf589a0961e949e262d707eaea74e867ecdf8e47ace22d44fa2fc35054463cd0
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize14KB
MD552590e322f9f4a90483aa75826f9ba5f
SHA1a53b1c59d7e16b573742a48b0760b11bf5c227aa
SHA256f9d66205c774b847d1e8ee3d13ac6e7eb7525f3fbc3a9c44fdee97c20ac1b25a
SHA512e92b4f05eeb4c95e795b82e4058c81c41abaae3611fc567d815c2087e0b39116e5d23ae141f1835cc2450962b76ff750e9b388a53106bbedd7c919df5c81ed94
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize13KB
MD518262beca32a104a45bb7d7e5934307a
SHA1538d71352091bdd462a5ae351c43138e0ee9d8ed
SHA25606130794ad5a36a7e89895affb192a3091a42b95c90952dc61b48768abaa1ce0
SHA512a4559ddf36f3fbe6da2cdc0e90ba938531532f499e8ab9d48fcb7e81b2a4fab87c46aaf4f4c249f4c4fc26569495c2030b8a8aeecefe67a9e579fdbdd5343646
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize13KB
MD5153395f49eb5bf5814731169e0d00d91
SHA1b4cfb46272bdbb19dc1f1f12cb042d6cadab6807
SHA256d6689c7ea2e53967c2ef32905a9e60d13ce8f9d51929b206e6e1e7c7e9b44216
SHA51216a0b7cbbdcf046839e82b2c450c9709f3e4ba70e0408fd36ff897a6b1fcc7ac8ae4ac4166622f59af3ad64ebeb8d049444fd75b320ffcc422cf0f4ac7eaeb5c
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize19KB
MD5097cc8d0c61c0c54ee864933708f10e2
SHA1ce078a29d33a139d9a992f0e59620a3578f6bf22
SHA256339abfa0e86e6ef61b0141f8facc573b705af693afaaa735369df6bbd36254a0
SHA512b540c788f2ac0eefe67fabd2a9a0285f8ce74908fc7621f7ba03dbd2c935557559327678ace45350c2133578367b5b9dbfe777d68dfac5925ed6a61cb7849209
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize16KB
MD5e06f9c21c9e1264462b742788d4bf41e
SHA17327d263d67321182c2aea57d4d58638dda9e322
SHA256b68708f914ce211abf08cadb3194df97e34ae0f10f79c635916d2d7a3c34196a
SHA5121db0536c86f4d34cb76533828e6b45845fe417e9567bb56451b1d89bb166cdf04253fa7a270ce6e5e9b2c66dfe6493f063b35a68be874f790c0bda22838256e0
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize16KB
MD5baa34c305a2ab9c935e29cd24fc1713e
SHA1b5ae2210fd104e6844279116d7f504af330c017f
SHA2560f98b6e103be15b805e56042a109b88d4f90cc3e571174e89282ced577481383
SHA512a83252ce3ac0a556f2104e9af29c7698d734dffe156de68736e5f730dcd8e9882c26db5ecfc5a7abd3033a7d471780e60f95379ca35cbd7878efde55ba173f68
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize17KB
MD5632ce4228f2e844de67911a9aaec4495
SHA1e2724cb4c104c2de69af100481ee5b213839c754
SHA256486a8bea11a49f3d53636b6aa6a5d1fbbf770ca05b4df0afbe210912f9600dc0
SHA51216d57bac6ae15728f8274e09b7e5bd122c74980a5bee6c9fb6f7e138605f03659541fbc30f6132c10f4ca4498fc60fc74043c69077e19bbe449b6ae446c6ccb6
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize19KB
MD5d74e135ce60a201906df6c1d65e94948
SHA1472c114d356ad880a866ec66ba399382ae3187a7
SHA25687be61da1bfeb4bdaaebd5b8126c15376018897e8548f25b976f7773eae5af7b
SHA51206a188052f86a2f3285f65b421ca4cb663364a366628128a3a23770d17a0236b3bc3745d7238b0d79ec5addf073022b913e77fc2e40c4d1d47d0da56544439d4
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize19KB
MD547a6ad1c70a5d229fbd3f0460d53eff9
SHA19f1989fe9b52d8de0ef11d4fa61ca972e16da963
SHA25685fc7d09bd5d7031e4624f64f4436eaa3ea2a57030052dda24d950932b2c6eda
SHA512fb4ab74b948740fb19e4a5e4f8e736897e94a0490e66afb1453f36087e4beed4c8f4b6ce3e0b74eb6e71d0d0dc202e5a1a36656aa3f3d840752fcef6f4661ef1
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize18KB
MD5272a3bfe55e495ddd0513bcaf61c799e
SHA122ff27c4a3fe402beae9a536ba9c409c10884a6e
SHA256dd7dc648e24875fb30756ee1e3d8469838cebd1e5f128e5de08580494ca6bef0
SHA51244b9138d64c5fc6c8eff03e50c898618effbd80fa2381114b88cfb5e0a1a40df588d1f671ee0e8ce009b262e2fa0b9fc96f94dbfe68fa332821794f794d3e53c
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize6KB
MD54c9455e53a64710caf5fc4ce09444acd
SHA197b91d6817092d07d869d48ab1603f3dfe5ebcaa
SHA256f52409a63811d9b4bae1e941be8cc1cb89aab63f7639c7996578bd8ffd8f3808
SHA512fbba7d297e5812c1ad1c51813a87f1f2690c43b5edea53d1e17d026deef0f6b84d3335d88ac0f1187ec33aae5dbb4d35d856517e273185da120b40da4df2127a
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize6KB
MD56b9129ff8a472fe4819331361849e109
SHA1cbb783324831486f4a0cddfad6ed08e73e8d050a
SHA2569e4389f0581e30dfc063ab08d94150e8599832aceb90f4e3152b9a9d812fd74e
SHA512c6859d077fd63397830b625b71892315551704fbac67f8687a79c341ebe88d033dbe3f5fe72fe1ccda0019c4a7792708a599371b519ecf4315fa528d970c36b2
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize9KB
MD5e2881e67d08f5aba24e359e127f40807
SHA1345a94948bdb083420de8a4a87955a9c9c4fe045
SHA256c9217691c889cb81e3cf2e77c1506ad2fd8fb2d8d8e3104d0b1823ce2ee799eb
SHA51273cf1cdb159554c3d4fbabe5dae4013e6f76950fabdf5a2c1451e14abb12846487eba37f5dc4fdf3da81e942bae3b4961f696001dbe4c26cebf29d3b3651bf14
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize9KB
MD58a82e440fe685d0aa686f5744a82e70b
SHA13bc074efe07b51d96e55cbd9d6380592ec20a2f4
SHA256d74cdda131d9613e337acfe426c7e63cff9ff4d4204958f8ed54ec7aded4d5f4
SHA5120b8336808fb4a5dac841f51a4c4a2955872300906c81ab8755f85714be55f0dd0759c467e274aa6e0c215fb34b1350b0a6e93cfa3a88c0a5c2ffe2e4410c5625
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize9KB
MD511a24054f3f47e7d5741e7d3b4e8cce1
SHA14e18b72c6327cb5356baeda0a02c336960f97757
SHA2566813fef954305a32808339086436a47f8514759b7e6f54020fec30508bed128a
SHA51298e6b6c5802cd24a301eeac5c6fded85365f7e8da8942e8c78ea47745eeed1d66c20d5b40fc0f5ad5a83c86350785a297c363da26cb4d0d09e8513d391835385
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize10KB
MD584e491d4042d248517213d4af737c6f8
SHA1151a374e816e7cecb057bf353efed33b2dcabd3c
SHA256c4c7646b3f652e35e7f20376dbd1f55f4cc9fc64e30418876799e0e73594b420
SHA512862ac98e00c26464fddd89afb2bccefa4fe6c60d9a27b944dc5d99245e43081d560fcaff2c561de6132a8a2ef9a46ac31edfb0e861facec59c476046eee7fa39
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize11KB
MD51ae6ea272ae0910ab757bb77b7c56d59
SHA187d127a0868f6096a8083f87edbe47aca289345b
SHA256392cc67d291962ed8b9644aa48fb3569a56b376038110206714822366844dfa5
SHA5122136b708280f339a8a5ffc07b8914b9f552b9250e6c589e9394a17d6e4c4310166b167961210952fda22c2b456dd3e2d0e7f767f97052e6e892de8f0565a6971
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize12KB
MD58a049a184cea1131c6e01cc7fa80eba0
SHA10bf88c845f7c1ede87d38c5e68f32941ebb758f4
SHA256f11f094f89d9c2cf8b5cae42b030338a8c18f5d26ab1897104a26bec4360a256
SHA5120c05f6e20027570532675e1944ad57ecb19f462b43ca0364d471389dce5db1522cf131006e880c6819a16b07fe7a76104ad7145c6f2795a744365316b30947eb
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize13KB
MD56b121b4fa022ae3381e9262532e2a905
SHA1b7288aae464491aef1963ec0f3dbc6a8be58d955
SHA25668946e113ab9fc5639b500f8b11998b24d8695f0d41d1ad226ae4c1509f5ed22
SHA5128dd3ba107c3d3849cc48a4fe93502a3e0aae960c94f2901df90dc3a841543a6b3df500dd44e145f0b054c368211f532bc841fe5981ba8ba3e783c5cf708513b7
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize14KB
MD573b4b358f14cb4070778003919ae8728
SHA10c040b77942bff0af652f84653dbefc897e2176f
SHA256aeef9f26a84c4d442b549cc0037bf4ba5b3ed2ae2f90fdc34d2e8436dccb6b44
SHA512b5c1ad42c6c1e6234b331ac36d4727c195feb3fb0ea8fd47fd42d8ad08d54460f2ed43e9b1e4da02ffb1d22af39fba5f1f2ad2d032f33b263ab9a00a1abadc7a
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize14KB
MD5fb0bcd5c8de636136086b38a4ba7036f
SHA14bac875ba4843686a72e816eeaa2fc4149ee7da1
SHA256226f49ca07b380b0e34bc296bc52cecf9d1339e3e4fd3eb174cffb3251e41dd2
SHA512b68274b1068e80c7692883a361d2b6567b899817e618e30d1639b3f7eda1ff6e118156e70f4e21ca72e761b94c08f59d6d2365a7a58d368f379a70d750a460d3
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize14KB
MD5974ffa53dafec93cbc3b428fe4eb81c0
SHA1062428e53f1f7213105f865158d38a65bf4ff6bd
SHA256c2ca71895205d79b486153efde93674c1f277d74a4a8f5b190bc5faffc133642
SHA5129098bc9e2433e43fcb98557b571fa7dacc7816befd5b35576889f987e9f4834a1c99f3bcb78eee88978ecded79f00deeb790d6f7270507878bb81484cd80a39f
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize16KB
MD5771a008150277301520a9a5f86dbeca6
SHA116313dd6e4bc6bdc10c984641b0ebc1f9602e46b
SHA256634dba6f84d1bf9cc54290c21bbfc893f86b303c71ce8b990bf5494331776135
SHA5120deb3b4a031ef07737e104218dff1b285742d2d0f53b64890d66ccde4c451c17c3f8d78b273d1d894dae51f990f425e4ad747845ee8ab1381b515088698beaf7
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize19KB
MD58432f4349cd21f0f318c4dec7cac5931
SHA1cfccc7f75d627f2c1549122daa0ce4512437c899
SHA256ecff937077f2cd73429580eb3b1cfb50d80d69b003460b801975de59fbc526a3
SHA512347dffa2fbe8a58463290713aa7f3ad7f1f7964eeab90bc600b22955e0920e687680c269cfbe926ee235f0bfa3222e1bdfb03757b8d69384c98071bedb5b89d1
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize19KB
MD5ac540a6fec4e7d4ccf74a03b54e3438a
SHA13d05731200c2b6d88a1e6d9ba93995bd8a7586d6
SHA256de6dafa3937b8988dc9ca1d3c28173673b356e7e72a88e9a9128d1bf3f7570a4
SHA512a2e888fc267759fe0eb0d2b0a6f1adf4c19199e13a0dd7bb2ae157852e0b16c3608ea88e60700ffd92978fe40d9abc4ddd550554d7a3222ed0a855e7f0201ea6
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize19KB
MD58e4dc1fdbe32f5dc752b02f61e0459a8
SHA1441db905d9c441ba26e6fbba9f2e2ee965174f58
SHA256fe8309b108552f89268b6d93ecab051f5c6abe0940d96f18ba69cf092e17952d
SHA512e2f96501d54eda98d5778cd9449b27f3cfab9096a407dbe1adccdf075b4859d3a98fe459050d59ae4e63c9dd79b8437cfc9c547a4fef7d7b102eccc54ebcf829
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize6KB
MD54ea48f0590095d897e1bae80f41d2a19
SHA16181715279b920d6ea2f4df1ef0d1cb818521762
SHA25661ee69ca3e1d9d01d7e90f47f56d7082cdbd736a4563ed766a141da8150ab90b
SHA512cb05e768f1e3b6328ead42a7771a8be880a766276c3a0c05eae21fa9a58e96de877995a4c2dead497945ecb4d6a463006ccff7f81b7e76768f84ba164907a963
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize7KB
MD5974259d87cd559a1e4a8883009690f75
SHA1f3b6fd8f9a25e9a7d0ba664ede295819fd2efd06
SHA256116870a32551eb7907cd8db34cff59915431d72195e6e3005d6775a40b6b3cd0
SHA5129c588410a82b4b81d3fd3a73cf75624af9926a61f01a6a939e695d84719bfdcb123788623146c390670b5d5755948dbb10bc40f750ee901af92d56bb2b78194c
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize11KB
MD5324e4164e2635ba597be84609677c40d
SHA19362e6a52fe8d5678628f3d0619761df16bdb293
SHA25685306dc2948b8914f0721513554a967728b4de0abd549212b2eee462de856a4b
SHA5122e31d6f9fe0a3782b17c95a90c09887bc0c7e5d395680b7e2c4791725c62918ea3d6d453ee066c85406711878a6e3beab80dbd73dcc967f1a28615e27d344c4d
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize10KB
MD51ae20e5e6659c2d5e9edb657a847bae3
SHA1183122dd3b05d102da4d2d2f7dd401c38f15fbba
SHA25683ceabe92b62dc6b2275ebb45eeab5f65150a1de20a8ebaff7f85957218e3dea
SHA5123f941116210bc4052ae744d762930a359584089e594fdbe10780e448122d2b0842d7b748b039260c863d8cf4afeff10a2890c86b409daac8903827b3ad454332
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize10KB
MD5991b3fb649d1299d8085dfe0431f7976
SHA144b1d829cc5228c0d3aa0292d28b8063b4c5c219
SHA25666ab8a18b82ae0589364ce6a2c110a90a0e313ce2a11080ac2287c06ce3c9e49
SHA512a57563828b702b02c1439a23ada44ea976ca4d3bab41bcab1e7ab047028e56e4ffcd53542ca19e497329280d37e1d466c3550fb43f9359efa32cd774bca6b18d
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize12KB
MD52a6003d78749071ab470f00cb46033e5
SHA10ef0662b5f703f0bd8a4f2faba82afe2ea5b35e7
SHA2561752142494c9e03ae8575ca72d073aeb7ec6cdd22d06464a77f5db4faf3ee245
SHA51201212ddbb2697a987fcfc68c6dce71407e3a49f755a7833731bb4ed8dc216c1c8323589e00c62aa1549f8e983caa08aeb3a0afc7a6b4746b628c122ffb207dfd
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize12KB
MD543de0912e1650b31f5c1d69844c917dc
SHA1c801742a89a0a8d9096ac68a5abcad7cf03b9140
SHA256f62307bfa69a865ea98c52aa8d1c9432172dd7dd7b6f8c35f9b0f18ff524aed4
SHA5129ac0e75ebd5527acc1847e3093a759b6fc5a7dc4de500c1482cd269641133add78fd22cb4a9c167eac09f06abb8bcc680ca3480b0441fa682d4bb32a600e0fcf
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize14KB
MD510e9a039606d83088f35779d37ba6747
SHA11c3269a4e8cc3aa0f2d056908332f64cf0a19085
SHA256848c8be8cf73902673e82a07e06008056273c885e545107d8590874158c12421
SHA512e7ddc36c4da74567c4e6f2fae00581053fec62367002add46fb57e5dc67c1ecea1e388c556a3035ced62bae4973a1b6e9a945bb728345e879f47089d52321c6a
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize19KB
MD56f0e9a0fc08e2cd9e3830f1c63ff827b
SHA1142e26a47e3f0ab9a1a2489577136a391a952109
SHA2567c202ad76d4639d0e004e2087dc4ec48fad29700a85efcba6f6386ac5ba68385
SHA512d62855343518dd9816a7d6b5f1d250b2904a1ad036e7aff83e0df8ef09076b7a04091f3b14276d7f151d0392b9111e36e740a56c1fbfc899431f7705071999d0
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize15KB
MD5242e113ea881302b81f1f463c34ab5e6
SHA166f6e44d156b051450bb8f38e37712aa1ab95684
SHA2567ab7b791cc0f769aeae6c8b266842edae66f4afddc1b524d335c689457aaaecf
SHA51286349e5ec00be98c43d771ef81c7a9767e11912b94ba68d4f3839b499ae45fe5a89caf8f2827690426c0cc974301a7b59ad333980777c2f6c87e439f051c51ec
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize16KB
MD5a941199444d2eb8a6dea2651214c5eb3
SHA1739bfca3e65c2964ab6c2d85c0b31804261061df
SHA256addaafff13764e72d56cd0a4814f96ea22568865ed30d01b687514f6a24a4c8c
SHA51297054de2a14e5569c3476fe07e89467fdb885a35740d2f64337b551b9dea87f0ef9d91c173206f2b202636ec6ec97d91a60d52af439290cb7e70a79af5fa4330
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize7KB
MD590c649f71bcdbfd1209f5981be656618
SHA1bb6d98317fe49c928104c8832d4058143614b0a1
SHA2564bee8c29a3083575e1912e6cd7f883f6e6bb313000cb01fdf731842ed247d1cc
SHA5120a574ed044abe596526b4bba3d5bfe2c6abe836f6d8a4a21c8efdecdb87ef550fbfcdb475a63c8039fb3238521e245ec2bdb13ba2f336dcbb8faa682d0666b3a
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize9KB
MD5e1d088a2fb8fc3afe96bbf65ad4d0fd6
SHA13b7d47d9915551833edbc217cf5b4b1e7dd2ca7b
SHA256a76017a14789bd3609b05cdbc4cd9ef6da9dac3f0ea6d9c47455f15553c855dd
SHA51260182cef70d040dc02668a7d5c61663cac58e994a7d711106ff52a28f69e134c6e3399f34f47966717ded7b146bdd284ad397f9732e0312b4b4978cfc53a1996
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize10KB
MD57582af15b0d55ecac3e7198948ef5c69
SHA1e78dab80523264e3a16d8a6e3ab2d083e09976fb
SHA2564006ad340bfb714af750db22d0c1e3b93436bdadbc0952813339dc03ca6bde45
SHA512d5a5375c22b71560089ce1e6c9194852bb7db51283b4fe8b1fd4237e28aa6cfd8c8855df2821ba4fa49a67455dfbc2ee2bff9de8d4d889195764115304bdf7fe
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize12KB
MD55f9e531485e1aee87ba8193b701d3565
SHA165d63d908ed18e16263c28bc920a8621930558cc
SHA25631c3c8e980e8854929211df88e9c21f751e0f5fb4ca72fcd876386dbdc203e06
SHA51219153833b922b5091a513828c34341125e03e7108b512dbd78fbb4094f6aa9718889078837620701afa549ca4e7edad91cbeef396db171ab5ea6e22cbe79e5d8
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize14KB
MD5c9663daf5cc400a668c89734b700e193
SHA1b5d869fd913f8a667cd977af8caa8a0d9ddaf88e
SHA256aab257ded3928254704cee62aaaf5ce0fa656f324fa62f2aa6e4a90a832f5d5d
SHA512d7cdbf8d08fed7b64daf622d2fd88eee446a7f97148a9787dde5cdbbb80dd00c321dbee1f2b349e2f453fbf0ddc46fe2868c77befe4aa6e22a6592249eddcad0
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize14KB
MD52b9b83fe4b1beea608bbc2fd3cd97b79
SHA139a15f44bfbd29aba1a8eff7952baad399f1fe6c
SHA256d79d68cde411e4fd82c4486ddc88d8085ebfafae278f0f5e2ce68d0fccc0eae8
SHA512ef1a36d729b65ec2d70dbf667ab836651c9f072357550d72e102d0657978d1bba222fc4ac7672c29d8a376d8a10e8ddd65d3e21e01fce0bebccac63a0e09c9ae
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize12KB
MD55940b32e67cba3bc22b36b4df86a1502
SHA12c43b1167b48863ef7c188addc66044802a32b89
SHA256562d55c9c93cb0d3897819c6daad3c4c52a6255f830dee74bf3494205085d24c
SHA5124afffd43cc43e6fb10784e761f5e35319ab6365b6cb4beb29ddc4dc618a123ea4f49100369b62e06a5643769e968404910e73a518f2de33b615614105e6a5913
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize20KB
MD5c95cc0e77948a35fa4cff164a1abc0e3
SHA113a4ac790bcaa8d002e3b1098b6f5b1e287cc587
SHA2565b8a9cfce669eba5a066a8df45ac21861530d6492b87a6900e5273a85cf332e1
SHA512e96d74094310bdf8b4358cee09c72e733e559cb1b688203c2fc6499afe1fc1081bd642a1b2652700a194db51e9942050298a7b0e539cd7914b82e1efc07b373e
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize8KB
MD573549f56180e5a7807cf3a70f38dd21d
SHA1d1ac21d559af4c11ca1b738f938a2c702a89272d
SHA256dd95694fd3ed60420fd6fa16ed4df0fff6bb2832d7f7a2f95b78eff13f59666f
SHA5129556bcb333d6456c74bb87253640818a3edbf7f475db5897dd3d98b05895990a8791c2fe199826d90a2f8f507a3f0fd49ed0f3a2e0139fcf1588e1a88c99beb8
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize12KB
MD53b91015e3b54b5ca9f22eba3a3fe4274
SHA1fe46b43f41638a582dff0c442022a6737229d449
SHA256fb0906310aedd14ce73d1fcc5a8bfaa465256f618c1487e2a6603ca6b01743d2
SHA51217800dd408a309b5b93558b5a2da104fe7982e4fb8c22b0193cbd59807825deba9f33b1e4054e1781e5ba04170a4fe7295f71b7ff1f900e4bf04b89f2341327a
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize14KB
MD517f653ddbedb1b8d859e62543e4b69ad
SHA153e4fc8e25dc63bb46b7482700e5899873f57457
SHA2566eb0a0d1427383c898d0448959397cf8658016e40dd65587c6378cfd99476fec
SHA5124f615bebc3decfffcf6bbece228fc43cac6bd922483a2d4ac5fdc1de48c9e67c40da78afab881184a08d3f43de35f41fd61f862fa387dfd30015419514f92760
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize15KB
MD583b125e9e3704cf83afe9e545d79dc7f
SHA1239a2638232114921468ddaaf685a26c8bba5db0
SHA256600e386c0f70276a0a8a58777a4061ce2dfa78ae2fe16c7b4b7022a1a2932371
SHA5122d1fe45aab6c8e87a96b5c0169a719cb954e5a71b05655d56d255797ab5495a847f82aceec9400bcab60debb5a9acf075aad7b7878806f6db89a56b040354f10
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize19KB
MD58370dc2d14b0aaba0e15b0746a9da8eb
SHA1c6340bf025265f25f772ac34620e3010138bc6e8
SHA256152bc9a68fa286b08511a51b18aafc7dfe61d0494317d2ad6391bc804caa310b
SHA512ad54b3fafeb1e1de643e40e49efdc034357d77f28d7bccafa32957a66665ad36363d3e25c8849742ffc59648fd58e0584b74940b4b8f02260e158aa8cf6ed0cb
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize11KB
MD5f46040fd7af71e0383e486c2b077223b
SHA188debd9bbd4d1a4a7d0cbbf7edd7e24ace3e9d3a
SHA256f3723abcc09c759629e484ae007e91605c9f46bf904db1d33ba3fe304c1990e0
SHA512dd8830ab58c636b77dc88b80e34e75f2595ab6d2d7beb52a73b00eb0d1cc324ebe27adbc8f0d64125471784eb2dd9f498f6716b51a3b00ad037ff31bab994ebd
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize12KB
MD57531bfbe40f9e5993e22cf0ba95279f8
SHA101dd793693eb3b275f2fbff684575f00ae85d48b
SHA2563aaabd008b2a8e1af2626394fd67ff378802936fe8f0d1ae51f0187f03f6955e
SHA51258454aad2cf73ef848a4e65dc95cba86fd4bcc9ee219592f0727331b811f58d3c428b802798f4c6074332799680716ab90bfae9143ac2b32ccaf6b66b13a5958
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize20KB
MD5afe3409bfc1346a869d635e480237b52
SHA119e30b13db52248ad316e7267ba24f6c9a2dbef1
SHA2562ad7e0a4a31dbbae7c938567aec2c03b207c95270283cda5a5ff8c17cd3eac24
SHA512a362641c2abe8019258fcdd428e56fadcff7a7d3d4bced60b2ecb91485727d67bc9fa01c3bff52f7f871501b291fda4604a94f7d9dca3b4c635527b0d9ac3d63
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize9KB
MD5ad1cdcb5495e7fcc0a61968caffba1cf
SHA1d908a25002b9a451cf40a900c5d7a5ed2ff3f9d7
SHA256da814ab98e79fae32aecc0d4569898eb2f6cee0d61b150f975537c2f8012f2d5
SHA51299dfd4adc0f37d01e18ce32911aaf34c477b34098e4ac7fc544c7724cf2178eb1996738d8fb959acbacbb9a31ccca718041e4e65d3f0bf5453eff270f41118a2
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize14KB
MD5d5dde079c44f7f3ed52d6e3fb3b6a5b2
SHA1e175e2b35506d7cbb6c465d0532d2c6c220f9e63
SHA256e6886b98132f050ac3e5b266ca906c46b5f6e1b2012ebe2c95bbbae250a50183
SHA51264ecfd8968cc502026b1d1fa3444baa65434dbe3491ae501ed4efd293970b0078425fc35096ab824759866bb10be1cd2cc32b61686d783a89bfe2c5752175f13
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize14KB
MD5283b806a8b0198837a1c042da4beb39a
SHA1b6f071be25026ac3fc0b14cacf2a1fe6f358c0a3
SHA256a616bdf0290844e9259a9377a0383a4a2cb0398566344ee065be8a3a04849dc6
SHA51260a1bedb4c17f74cf63d6eb1a51a5b67c046a27c3ecf5ca595a2c53ca81fb6fe1328a5f4fb0be27e3268eef7de65f443e14530a430edb05f3092fdd44ebe6ee2
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize12KB
MD52562b226f2920f10b22a271506b2cf2d
SHA13384e5660bc2e7736cc0d6ba54abe1dba63fc112
SHA25603235ebb3cd43215daa83008427182d7a646ad06018f670d56b9bad2bc492768
SHA512402b07f8cf0b74c4ea40c90038a57e0a73403824f44dcafa061acbb0519aaaeb5b8443933d9bfe00d08f8c260f09b1cdd11f49f12cbb418f1fcc7b30a6e235aa
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize10KB
MD55d0c04da9752dc3f97226beab77bcca0
SHA1d756fc63241a11f43374f980b05d717dbcd84843
SHA256ed2a187cf5cecc64dd5ea5cbe232ba6f7625215cb940ec5a0fefe057f53a3e43
SHA51256702ca43d506e78e9e78a8eaeb32bf3046e54fa54f2d05fb5592dfa3053ea95ccd263b3dd310bfb0531b0b7198d7e570bf0dc098a8101940cf08a66ceb4f38d
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize12KB
MD5044ef950958220880831ec6a2782320f
SHA1303905f432116e20c2ac8ba15082acb3694a7bc5
SHA256ce3eb17e528cf3535868bf583dfe4ad72361014635f953fd468509fe0b499008
SHA512ff2e8199996d8f7ad2b68ccbb5eaef5106e0bd7aef657e92c6dbd4979b752d96940391889d9af673abc0fbd6dcf76243ee7d7313a748ffaaa76c732ede065f9c
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize12KB
MD5d4bfb22144f86585446a727f0ff7ee80
SHA17b7405aa5cc1faa904b0e1e80c93e5429815911b
SHA256a555e99c024d460e78abaed2e5ab5bdc5d34219029b32110826e99073a1d8cd5
SHA5124a630cdd69696cb5904e24af902d5db12553455770fecd315ff5fa79eabf998e37cccfd75fec7fcfb74dea5399624615d76cf4b7709eb461423f0d1a9a00355f
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize20KB
MD5dfc8d7166c870f0d6e28056d32502c31
SHA12ea0814ebbb596984f3cd3caa47e78bc3c8bbadb
SHA256d9aefeb7495291eee6d0691db3fcb290ab02ba24f16de00f203ec44c1b8f5767
SHA5121ec50b28958d025d5d54e0f89fd5437cbfa9200b721d53003362e64bc3e19a7be89fbb0e88fa1336b68639bafa0d0790e87cd4a0d3acdc28567470377bbb5519
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize14KB
MD52fffa632efca175d55fb1c9b4fdc9332
SHA1f2e31a74116477e0d5e1e18872f578e7e3fa331d
SHA2563539cea59473185c7e2272a758aeb42ab9a2fdcb89b9493646cd4ab38abc5c35
SHA512ab32617c3e551053409250b92da6512f4eee4499f7b66cc3fd87f60d9c5f470fe92bb552ffefe24b69756065ea03e3007463851e7dc3850769e5336fe6af6ea4
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize15KB
MD5d935aed2ae86c79fa529884c9af85072
SHA1b449669c160b4cd9685dd827e1e07340f930812f
SHA25619a1c9d9b6eab1b4824e8863c0afb96bddd7c3ac3c5ab7d88af2d78350e1021b
SHA5126060667ab45e0441e793705e94ff2b31f85ecc2f504ba39197fa07c73db96ad78063ff49d50aa91b4ed47885a5c0e13e3fe7a5a2747a6bfae36ab5d5fc4e4b32
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize17KB
MD5b7e6da134c6fed673f15171ddd0f604e
SHA1d3d40c96796ec2add913d66a3fa42ade0b5752eb
SHA2566866f6582d14c0cb092fe6f768951220b710e3211dd050ecf0370a304ec1f9c2
SHA51270de657d088b0ec398356562fd55c87def5137659622bcb5234207c3b729f09820411a564399c26b20814d5130e7843601ccea9f94970619f586ce1246886ebe
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize20KB
MD5131cefbd24341b617a689c34b1aec7e6
SHA125b2428737bdcad2fc537a78f93b30e916475f40
SHA25607b6394dace5ba55832c8db206f9b69f253e5dc3c42572b4ecdbadc86cd39d43
SHA512f4f6463f3c9629e023a5adf2e09fa71dc821759dc0d8908ebd8aeb5da09905669fe2196504f55d5470ddac58bdda77839f076089f64c2f0418e3b9c3e73d36d6
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw
Filesize19KB
MD57422c17de300a55ca797fb8f3029bcf2
SHA1e2d2a4159c7391a50f7a08ec771ae9eef3aa9e28
SHA256ce04fcb731c23cce906b07bb7c90de923af70b75a07a990f1a95f4bc5df1800b
SHA5121e2dfe2f329f30a3cfbbee4e0640e097d983bbc14d27c350b387365984c5e172dd18136192c34a8cc0ad31a0df6e0d6458b5c454802ef1cf7eb6011405d25506
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_2748fad5-eab9-42ad-b0a0-9db0963a40c9.raw~RFe5b52fe.TMP
Filesize365B
MD5c71d783b5b319af778d623b99f05bf21
SHA116ff8b4fb7f8d6935d368c6b29250c3e995dad46
SHA25656db76d37dfbcb7521e1e253d4b8b31fe0b8e5bf40802d993157351f4df491e7
SHA512f169612497094a420d08c15971b9f5b261cb36ff9e39f71aff3c380eaa642f8059d2716e5a2f61c7aa8358c92ce590a3326dede89032f8b8ce23134118139e1a
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\WebStorage\3\CacheStorage\index.txt
Filesize75B
MD5a960eba27458af7b778cfba7b36c7ee7
SHA1e2c572db97f90853690230a65e7318997aaff6a9
SHA2566079fc3ffe4169866f598066b01d6a96dc41e6889fe5461f41506e248c73c266
SHA512d4c2da12cd7dbfbdbd2e2dc49779df31695ccfbb13a0556d08d39303f40b8ba0343b15031b3914393fc1fac1eb7ff999d641bf80ba2b97ebe3d6b7796a7cf077
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\WebStorage\3\CacheStorage\index.txt~RFe5ec86e.TMP
Filesize139B
MD5b288d2bb1ad145c661deed544f18fa6d
SHA1ae30a264f4751d33f5e47e6703c2eb15ba4b2603
SHA2562494b7dfae75a4377b1d8ca6bcddbf727c632d0293b8fc7db13b6b58e979010a
SHA5128eb3d956e98b233b917e30bd7ba43a946ee382f18dd2762d0d7ca42707355704a833d786683db86193b0cb0df67e20693ab5f2be8f65239b2484351f7ad8e2b2
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
Filesize
3KB
MD5aa5f75d322191b2b539245e5ba57d404
SHA1969fcc5160f163d85670a4f98f0024b076fbaf61
SHA25615d7fda7253608972fe0584d0e20636f8c693f4da30c15a6bd02c03e88e4a8f2
SHA5128e54b63cb7d54aaf335f09231ba5fce918ba8ca42223486aa3b464007af6b04d3a59f9b4bf1ca3e094da000c9920214025cf4eabae31c3dfc3ff08461f60a1ad
-
Filesize
407B
MD59a171dac07e76b80f6183d3391686d67
SHA1fca2741c2dfabcf37762a5c0867e75ca4e301fb4
SHA2560cc19faf2ab74b87bd0a3d9f591138dee60c1b19b9e469ad5aaec7aac139aba1
SHA51265da74e585fac30a269b386cbb47e03aced46245b036297bb17407bbabe6a62d02be7647ef8a5d220818387155e53e889010c89aebc29323bae4974486e75012
-
Filesize
525B
MD5b9137db95e5428fe5d40e8a7f51cc659
SHA1c505670f1b69170acdca94e49f9d3cb06a4a172d
SHA2569e476ddbf074c2c92833079468b880bd4bb3da548560d5a33b58e63af8580678
SHA5125cade26c8c7fc9c1b15b0919e0e139e8d2693614fb72c3ff26f8c8aefdbd84eb76e1678e7523544d71385c0b89520880893d00b1fa3a857729f9f343d129dc58
-
Filesize
587B
MD50977641a4e8403cc76d53d71a0d6552a
SHA16c38021b7957156c7b19f77bada227d01a6f16c7
SHA256e147754dbab294b3336f69b4a3743d7ecc10e82477dfe3d0a22adc945727563e
SHA51233a87721dade5da126f15711f39b2de17ecc61a576a538a2725607c0eda263fbc0693f78ef5fea58138fbfd4c17c233e87f557b4e2c95a7056166c6801d347ce
-
Filesize
1KB
MD5e6f1c52d3dc53fe4e15b612e5ea2b965
SHA1d5a60e4cd68da169a02d515f9eafdd81158a1555
SHA256e7bdebdf1422927d2e8ff67fe2dbff3efea2c162b847fea0f824e6f9ec7c97eb
SHA51220c6ed9f2ebc3810c97aaa9f9a39ef4455edd10b13f74d13d8f26f0e838d545ad0a4bce2cfff562531b6fb743764da7a09a009ea3d7ba3ffa73bd13d6619ed47
-
Filesize
2KB
MD56f402384b96c334e85758142c413d561
SHA176c410d7e323f4e092ca216d0a00152a127f3343
SHA256008ca36f169ee7883888d1f22925b7998e114ab5045782a2d72ac3b7da99dcfd
SHA512884247cc97821c1ccab183661486754ea6dc74dfc1bf4dae2c3ce91debcba7cb6b9c918c796ff5e862fc2d9eac5d497f71ae1ffefe8779f1292caa500b385b98
-
Filesize
3KB
MD50d0aa33e8feed08799441389e16e568e
SHA1b379994e0373ab782b60b50c2b8fc292d3e3f34f
SHA25682cb12747ccd2f461d75b363fb2bab82d28ee9fb5c9291002eac64cc3aa9667a
SHA512e2d58f11661bbfe0b2fc71c60528816ff9b822a63cdbcccfcf2d3d94f29e404f167f31467131256b9c2fef6abb3c84800f1438633bd786811a2d3a5f4cfaeddf
-
Filesize
3KB
MD5959b0bd9f36a7a035507c0a7529975af
SHA1d1e0054d8ec8c5f79054738d8d4208624e4ba793
SHA256cf162b98fd4e9e0898a8e49b709e0d1457930af5d14ba391cca05f42e2e2b77b
SHA5128c78622ff446efc932dda2ba05a3d1fc3a1aa1b009a37f871e57a44de089e7c1dba3cc4599352b9eda66752c9ec86e01f108cd5d3ef69cd8ab140809fe568778
-
Filesize
3KB
MD5dd007333beb7a58d9860aadeeb8a6ee6
SHA1726eb48357b9945d8bc5885a032925a2712e32bd
SHA25655302f7642fb560a764f52a74aa636cf21c769c6f011a2c67a7271711f997118
SHA512937908e06eca76a111a07f219a319039cfac3f2df19b4b546f6508d5d240db90c1233e6e2855a568bacf366a935e4512366e027be0e37c12313b7b309a9221e8
-
Filesize
3KB
MD5f19077fcb0adef91bbdc040f83c93871
SHA130e34b6c8d2f3cb74fcee4b60738bcc472b5b563
SHA256063170eea61d2e2bcc3ca5e0196aadca3f6232a20183212075a0925830586537
SHA512c3d1a18af6942839e96fd657cf0e8f5206ceaea692099dc6e33d84309230d89fda45ff6a46c65281579211947e29de33c514123fba29872479e0f9f05c2a6bdb
-
Filesize
3KB
MD543f9df4a364554e201556611c2666c82
SHA105ae08536f562cb2725f40d111d5d2396858428c
SHA256fba1a6ce0712526680628bd372feeeaefc0c1d2dc6bd42e88d34cebedc147f99
SHA5122fc1c672b0e926796fce672121cb4fd92d5f7bbb8ab9c2e5e1cb2c32835124c19d5d29229b52b468d74229e302fb2e911a44a8369888f48a94b61f597b5e6fa2
-
Filesize
3KB
MD537ff99127a8d5162bfbca2778aa558ec
SHA14c8bca7461e9f5ead305c2902fe2b9c543e59923
SHA256392d814c38a8426a4e6fc475f9fda24699be7d05ed651f2602a5a45829d4868b
SHA51234135d1c3db1bba709906a333dc72e06d0708abbe3ad506f58c68867c737d28bbc3a6a925144ba2706e82881bdd621156605701a9c0816c2aee8e0f558e2ae70
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp1968.0.1373781332~RFe5b5d9d.TMP
Filesize357B
MD5f37a0c094a78db03e76289394b95b5cf
SHA1673605f4e015fa96878909a316259e05bacb0076
SHA25681b4c86d9b541b343d6a0e473ba91c05f4a0d4b43e79f390462991743e148332
SHA5124d58884ee8812a732b3c6b1ebdafe9beb7824ea1206fe1b186340aecfe08b34d47f61c973cb03b7bf76cf6fb287fb85bb346adc0ea8ba294b41abcf04c485657
-
Filesize
817B
MD59cc38694a39da156172d8ffcf9279784
SHA1cddd6d008c1514bf5a2c60c03f12081a85e2e7f8
SHA25698042aeb26d757676904671bf80008182e2fb3e20714f99e9689570e9f61863a
SHA512fb2fc1c0d1917ffa2fde445d7c4424bd2fa82c74cc7c07a37d7bb09dc896d9ffe76b20575e34cfde177301aaa779c4c92547bce616b95ffb2dbe3639953d319e
-
Filesize
200B
MD513636c2132baec981134ab17d8a8b832
SHA188b70d4dd99c4f8d25b84f55c1615d37dbb2ffbb
SHA256c03d9b2cad19740efec4d06f805b125f833350e7d62a52fbd851ae17157975e3
SHA512be6ef68260abd42983ef8bc968f3c986e2eea11a98e90dd1b57ad0f68a1f3ccf908e4c8c623717b67155254c9759dce8d13ab9a893bc89e620e055a120c220e9
-
Filesize
224B
MD58d16fbe5e0edce414427c2f17c74745b
SHA11505d0d638ae35dac7aac571c18aefd388466d44
SHA256a464ed2c7b0798335d04858b8c7b79f5f1f5d50f9a0c4b30de0565f958cf1b83
SHA512a7b56cd221b9ee472abff7eadd9c615be1a8d3ba8f87cdb0ff4f700d1980b7dcf106d33cc1211f61eed8ff0c659d3542aa29e701dad4b58f88152cd9b274875a
-
Filesize
720B
MD5b5e3318779899c83c6b67cf51eff6ebd
SHA1a76eb7f8844878b457ca1ce3cd582044890bb25f
SHA256d6c55fad36ac3ee794cecfcb4285063f8b97adeaf80af437d9e8636a0554e570
SHA51240a822e73fe5531c11be958ec0369465f2139a7371a8a0dbe7ca9f57b15bd674ce30630ca844d92789d849d5edcdbcd813ec9e173021fafc0f30daf22cf3e64c
-
Filesize
695B
MD561665453a27797e4a6f42d65a9e3b85f
SHA1e4ab96d1b35a9bcb8bbf7967be9660cd7f8b34f2
SHA256a6163e702ca185f87776c38afcb1e40e370c5ec71d456cbd7709c447c76e8d40
SHA5124caf872bc65870da32f3e34757f03f25bb67f6d90cd846deb047db8c48e057d377616a8d14c378ee4b2a39648aec2ff13b7542cb4c96a8f5f7ab794a7ed2a4e5
-
Filesize
515B
MD5757b428a31506a12b4d7063713e055c1
SHA1538e358fd1074403dfe26dd7f037c42e4b34e007
SHA256154f6d53cc207986a48d5f61a32907540ae4ee164a918502f6669d942df65934
SHA51203c7e89f7e318d4c27d5288c2b6e89f6bffa6c56db6d16db46df3e6305b1db3942e89be57fcac601ce64cf8f2fee2185ec1f7c9cede3ae42445ec292fcdf02e1
-
Filesize
867B
MD5c02c6b34b5f0ca8b63ba4be39cb1e9f7
SHA1a361a52092a78eae9cf650fb1d8d4beca4646f19
SHA256b7e2a82f08806191cc8fac06d3800841d1755b2c958e013cd9212918262097cc
SHA5129a9e2e37810a59b7cf7ab3eaa137cd3cfab26cbd151cae40e5891aef4cb2ac4f680dfaf320d372d650e1d60b5cfab0c76fb3c61328368d124d13f6f956e83b26
-
Filesize
1KB
MD52ce608ab4297197be6bda244b86fcc55
SHA1e6fc9ebb276d56714e00229b11a2c7cce87607a1
SHA256057a65c4d47532ddfe39843cf6bd1289f1a90bd77a97a86f9112222079c30949
SHA5121df36369717e7d46692de1d7994974bad91ec668832a66fc4560de2a76a454f7e22220bf587ffd061dcbbfb17cdab580d545437f62e18d5b5c5fe65d9e0ac562
-
Filesize
985B
MD55372157e58f476433a73078dd48bb4d1
SHA1ee818e3876590c657ca289f498f77a308d3a0402
SHA256e4303821846b39f24215d2f7cb6be82616e30b747902854e9c2473df184ab024
SHA51286ccb55f0fbf3703dfc3e0d4aa17e8c9fa5e397cadd342911da3736881e7a515f1ad4f8a32a6691c4c28ef92db791786413acca90e5cc627e51564714dcf2b86
-
Filesize
2KB
MD52c1bcb38fa3d90d68ec23587dd6401de
SHA10d9f2bcc3101fd3afbc8db9da93e6953a25bf7b0
SHA2567f012637ab7e99e58749cdcbd2c1ee832059978b4a7cccf2d949934ea46d3f3c
SHA512ee9e3bea5007584b55a5ac66e122d2da0f6a26f461c0edc3fb1ee675e0a0565270ceddd9aab672e76e438dd53679320d6956749a26a505a14713dcf3db6d36d3
-
Filesize
1KB
MD574d5c596ad9f220bddab8f4d753797c8
SHA145d555078d171772fd7524f84d4306e0bed57d8c
SHA256b23dd434647f73b812fffa815953168fa8bce261becf4dd41a5f59864669e7dc
SHA51232e63e4a197c2bca6a32c90a23bcd1eb10e2531763faa0328247ba2edee4a0baf396f54b080e24df7a1b11eb5279eaf40166c4c66e3edb8792bcaed2c979abf6
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp1968.1.953558465~RFe5b5dcc.TMP
Filesize171B
MD572e75106fb56bde5561b646696804c63
SHA1cf58150dc3da3e832766679ecd28408ddae5216c
SHA2561497fb9e31109d2f9819162a8fec703a8cad85200e55fbf15904ba0bf8aad444
SHA512421d7e665b202e6da471a763a00f748175640c136cbd854078fac0e8499c4476f5b93994862652adf90e211fda5e3f35f883c7c038fbebe4584e3d243074dd54
-
Filesize
821KB
MD5137a29415b4fa8160a15b2b8fd957991
SHA1a9868ab00ad74d6bb2bbf5954baef42602b75494
SHA2569eef1f38accf5243c58efa119d7e407c552f51ba4677e445d28cb1181ea3082a
SHA512ad22cbee3bf817627497f7ad243e8ceeb6753d10eac1e5ec1e9a2c6dcc2175f7ed79341ac1ccd935229c262ecd31df21000666f95a4f4603af0ed0553daa1ba6
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
3KB
MD5acb333fb5997df2afe9fc1009a379a85
SHA1ebf5cf8106103a892c696c517e206ffcca7af58f
SHA256e593fb60f8a00ebb42bb4ce3255b3f788555ab81208092de498434ca597f5d27
SHA5124fad91ce3090064116afe2baa8d37a534d1e3f436349c32f62222a67e333788fea280c32110f7fb3192ccd925681d1351bd572d0d20d994677a9da87f8c6cdd1
-
Filesize
8KB
MD53b594bd49ff075be6f32edbccb34283a
SHA1623b6e570d4beae0622188fdc774853ec57378fa
SHA256c82a2526c7c4205bcdc3ddbdac55fa84bbb4a5970c2910341486163f4c923f02
SHA512eabfb891a1c6ddf7232387ceb935a287db4ea72f6639e72352a96e5a5522f9ec878b5de113198ef27b401304d9b0506ef3af056868282af4718fd8df146ae60c
-
Filesize
2KB
MD5ef613840b703778a9f9c4f54c9b0251d
SHA19f99205e4cb655e47ab3b3fd470f7e3ec2432976
SHA256cd17dd2829340f67494bf263a0c8e8c4bd0fc283267750d103e63d1996320af4
SHA512f12992075bad7925a8b42eb0ecb15fed77551e38883a63599c16ce8bf9d75c4e3fca1c8803c65df5a60f08b9d72b774460d59bdedc9a2a9aacae4d4ae06fd389
-
Filesize
2KB
MD5be12fef0ddcb425b790fcaa32f3ec24f
SHA19770d90a2ec775db1e0ed9c76bda35384200af81
SHA256687ea9f15ab86ea4f3260f5706be0627ba257ad8d06e6562c859f202b92a1f11
SHA512477a7f75adeff148b6e9482269f49ef7142f90ed3611ab2031d3203b8d91c332deaf73e59f86aef679f94a7d5af3fa20c5738aa4fbf3121f805c1cb0e1e679b5
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\MediaFoundationWidevineCdm\x64\1.0.2738.0\Google.Widevine.CDM.dll
Filesize2.7MB
MD5477c17b6448695110b4d227664aa3c48
SHA1949ff1136e0971a0176f6adea8adcc0dd6030f22
SHA256cb190e7d1b002a3050705580dd51eba895a19eb09620bdd48d63085d5d88031e
SHA5121e267b01a78be40e7a02612b331b1d9291da8e4330dea10bf786acbc69f25e0baece45fb3bafe1f4389f420ebaa62373e4f035a45e34eada6f72c7c61d2302ed
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\MediaFoundationWidevineCdm\x64\1.0.2738.0\_metadata\verified_contents.json
Filesize1KB
MD53e839ba4da1ffce29a543c5756a19bdf
SHA1d8d84ac06c3ba27ccef221c6f188042b741d2b91
SHA25643daa4139d3ed90f4b4635bd4d32346eb8e8528d0d5332052fcda8f7860db729
SHA51219b085a9cfec4d6f1b87cc6bbeeb6578f9cba014704d05c9114cfb0a33b2e7729ac67499048cb33823c884517cbbdc24aa0748a9bb65e9c67714e6116365f1ab
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\MediaFoundationWidevineCdm\x64\1.0.2738.0\manifest.fingerprint
Filesize66B
MD5d30a5bbc00f7334eede0795d147b2e80
SHA178f3a6995856854cad0c524884f74e182f9c3c57
SHA256a08c1bc41de319392676c7389048d8b1c7424c4b74d2f6466bcf5732b8d86642
SHA512dacf60e959c10a3499d55dc594454858343bf6a309f22d73bdee86b676d8d0ced10e86ac95ecd78e745e8805237121a25830301680bd12bfc7122a82a885ff4b
-
Filesize
143KB
MD5a5ce6498c85fd6192c0cf8163dd1d78e
SHA10aff2338c879a878cd04c13c760133d9d00d3725
SHA256de20add60a38918cb64a20f26a13d59826f85c2ce3991dc4256f4c93c6e0e729
SHA512199e5db476382bac2fae6f3daba68a5d4013848c2ba82989dafaa1cb55922d39b3ec4fb428c1f7767321a1960d83e2bf642bd51e11f141ba96bc4bd006d29342
-
Filesize
152KB
MD5b062433ae4d3f520e0cae95348c6f8da
SHA1a89c27acaa1f903f3810d093ad9d0c6ed05c90a9
SHA2563021e458221610dfa9f56bdd809467a6e65872da106020005205fe6e5c4a0c68
SHA512d6ec18c74c1cd569376d86c6fe5d44064136434c09a1c816165384bef44d6544a48d3bb450712b201fce8a7031d3ae263fc259591085ae5990ffa51c1c66ce14
-
Filesize
15KB
MD5934d06660d3ab9d43222620cc8f1d3ad
SHA13fa0960ce5ba79907c2ba47749723e86ddd9ca9b
SHA2565bead0c85056598774de50b0530810efbab07432152bfcc9c00f3c916c50078a
SHA51277fdecbc9965e7e2ee90652c331cc8dc7891627f1d5423c32bf09b19e9554f143af67093e5e632d2b472146236147c8223c6b548bd3d1001a3abf94808e965fb
-
Filesize
77KB
MD56cede1da888ff9ab9d4ba4a0e1dc34e5
SHA12f616b0bb2d38d15aa76633c33ce8b56cb62bb88
SHA256285790ed98a289684036d601bbe9376a3b140ea2c9d65c3af15dd860cf5b8416
SHA5128ffe6ec8a70dfee8f5d7aeec8261370826a4ceb89a86dff865deb12c33ae91f2fd057022c9caf4e3eece62906e6d591057cf6f7ff8270f27ce027adb31d7ef76
-
Filesize
25KB
MD5399c5166479de4d0d3d3ce18a49d9db5
SHA1d8abb7f66c8ed96cd20b04da5c67e0d0313fe679
SHA25680a49aa6cb3a5c61b5205fcad9177f359ebf2b54f361bc7cb17ae6f24dc9b4d0
SHA512a35c34693abfe72e71e5e87c7ca08b8ccf5c05eb3ccba34a66a220d9cfccad0d3982ea1690bc01dbc5db291cdf417eae183f58361ff0b8d88d9f33ad752a5e62
-
Filesize
14KB
MD59fda60ecca37b7fabec8226df10e22d5
SHA1fc293e789cff1461b6caa37ef50986c50db2fd54
SHA256c044ed4d7d134d4f32daa126c8a3205b1763fd028ad8250a164ed768814f7f10
SHA512db5836615531070dcaa4ab26b8e9a5a8d68d6dfb0983965099cbd0fd3deefe1995dad255a861a5a6149f2086b94ac6af2b5e887605fbf55687556735efb09503
-
Filesize
98KB
MD5bb8651837f071324dc2dedfd320b7825
SHA10c324106993e3c601492f809ae5c2b3625d496b4
SHA256478135518042e8fc79befb8bbaf433a8e37f88e7d049282c6c881b15b3965dec
SHA5120fdb4aaddf3ae356830e0604e71450863589d8b4e685d0ae3139af2912dbd58f4476486acc905f3610b23a258ffd99a633b95b8a57b53ad506a7cee83b9ad724
-
Filesize
81KB
MD59bfd047ec3a097687ef910b5f702737b
SHA1eb3efd47ff33b1dc90964e6a505932a80fc8403b
SHA25649e2781716a74956998ef9a35bd3009482c0075fed7527e6ba4ae76b8d53aa3b
SHA5124944defaf595fd3910e89f6913b73f0d8e100e7fbfade58e3db2359f7804515a34e15d6e99fc8795381866a48b238f6c0304e8fa6343910f4cb4b6a82b3c159c
-
Filesize
82KB
MD517fb3ee139b0bbc1de93bf44ec1938f3
SHA1bfea862c57eeb912f5205f6e1fbeb0c1a2abbe1f
SHA256221a462a6fb34bdd847829d9cf2ed26ca872352f184c1f6aaf489e2825e08929
SHA512137042a8a47e87997812f991cdc79082b08dbf2c17e2a20725b00c04541b90714dae466bee2c001671d9bb79c8811c1887b383553a04184fe46c8a1a2537a85f
-
Filesize
53KB
MD57f168dc31aa011a1d4577f90420a2095
SHA162145bcb394bbe2be2fa495a7e524699481ed93a
SHA25624e23084d68b19d0e298ef3070e174599198f6a5ee8c7063cfb0d438263ae241
SHA5124cc2844363c1ed14237d601a798fce0f32cdddd6069a8d3ec12b17614ea559f6c0115b2643a65b80187636edc1b1fc87d27c1e2d006603df12d47d17e19dd7f6
-
Filesize
16KB
MD5f68ae61426ed82ab6736d61eb9596bf1
SHA1752438bbc819fef15670903d726c6fb44b240bac
SHA256248c2bbef07265aa0814103b5173b41d48aafbbfdcf531b23b8ade586c929e06
SHA51289311fccdd79d0a1b8ee79335910d4c3df454d9270d331f59de51db67ff8227c59d946c0f4a687f72c8442743f78667a4feadfc070af138ef816192ef4f1db53
-
Filesize
64KB
MD5de0fa40d1ec2a1f0e2d909033cd5ecbe
SHA1d1b2db3aad5cf5360471a503c0c194c97189404d
SHA256d0d8016acec4b23ef273f7dcbfe2520414fef80eba70721c1fe60ed0e1139e9d
SHA5128f01cabba673f0eb23cdee76933983daafbdbde9d63d90c301fe7f7c2fdac8ec5fd49b5db164f157011abff015db315da13d4586477226212aee06c7f9d4d83f
-
Filesize
10KB
MD59fc90d336b4d27c8262702f9622298ee
SHA11193758c3ce73d1b536acdd1171efe4ded012886
SHA256c4c2b82b495017f9f2c173af3b6c2ed820bfad328e7b8e42d8377931d486eca7
SHA512d7a4a7d979253f2988cfdf0539e71fb33fb9a4fa9dfcdd8549669f093951fe6c4040d6d4226135c74d6eab0583a73712ce6d38478b6f2d6b105b05b43cbcb010
-
Filesize
3KB
MD562254dae607939fd993d0ed9382e7c9d
SHA1cb7d83d293ad085ba3ab3ede062b0db47f7edd0c
SHA25699662e8fd50bdf6f1a848fd42f466b89b9db6a647c1357b28d10d07e1679d75f
SHA512b9c5753ee577bbd2e1b32214884b3ec7a2b578e8686d42ae2b2fc69b190a065be3832fc19e3ce0cd49f50db4008948eaf89310226911ecc4b403358c86b5dcfe
-
Filesize
15KB
MD5b8686ed4d1f6b9ff66c9554d4158c353
SHA14765ec9686408bc07cebfb15a5fa38398409969c
SHA25606ac968bacb78c3cfa302ff4c55b9d136fbd850aecb587ec8509af8f4f51a081
SHA512928849cb83482fc7baeb8b9d612b54740bc25db492d50a29ace34ced41ba19e9ad59137337f3798eab597e19ad614657ba8249b05ececc629ad483edbb331a52
-
Filesize
63B
MD5655efd4ef95bb49f43c78b75bc149520
SHA11189ef7bdfadbd76c9b1ff6bc2308e225b3639c7
SHA256d0fd523cb9625039170dbfd9be2f7dfcb312ddac081cda301f7848029df88312
SHA512cf742f20e911dc781376bd6f11187d51147e30fe11f4fba9321825b94439dc9511473c14530890d533c55bdadd3ecb948661b43adba958993ca979a62fda183c
-
Filesize
15KB
MD5eb75b281041bf3031974bde11600404f
SHA197fdb4cf456bdc9edb6c301f474c037a8992bc1b
SHA2563816bedd74dae1e01d6037f0c8ec51552ddf0502c9ff2582e19bbe69eb628693
SHA512e7cae2ccf7ddcf697eb1006ac86475ab507572bb540200f052f08bb7f4c701e40fcb94a01a01cbddb8e9768e616a7dce17c571f3977c20d557ae2fe7b18bd728
-
Filesize
18.1MB
MD5e2af6796b9ee4db1d8102ac3505f5e7b
SHA1634209a54f03c499dd04edce5eb1632eb0466284
SHA256c38dc01521e077330fdbe53304223eb6c37f222e9dcec9245f39009b02290203
SHA512741dd275c23b476d23b89be7cb8aff480dde7ec99d40144729dd078b049c03581652b2b4b20076ae78f6ec21c8cb642a0914660f1e22c1fcc4b9ba9854414d35
-
Filesize
6.5MB
MD5af6983a40f7d720cedf711dba381ce25
SHA1e93fa9c5b65b1cf8452c00eb7bfc01c359c2682a
SHA2569826e7439ae6b7b86501c632124f8cc385a968de8b99bf2afaacb215c62229a4
SHA51272e7823f04938f48a9b58d9333df35145583854baf07836971ea6776b207bc79efa8a9c40d2d51868bd398a737553047750a8f88c1b518ee12f922c051c90917
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
23.4MB
MD542d20efa4e8ef7d2bf875acdaac2ce8b
SHA100e8877ec7d2c357aa5cd3e4118d27d758cb1f4e
SHA25615044c5df80c26cb12a5e39a3939067c1f00378d6c89cd67c93e0a6f36d436ee
SHA51259587686826c3d33859fb34c568ec65d0264ebd9c4bb685c5db9639073161169ebf7b8e6818f42ee569d469588ab10efea265697cd7db6b28922088d15b27741
-
Filesize
784KB
MD5bd192fa5306676cc76b6614f8dae788f
SHA120541b76e5ca99eb7919558d6683bf09a2019d64
SHA256e8b0f834fb360438e0c5cad96ff2f54b95a2be98eaf99f2a2c31f3da27b2e608
SHA5129a3b0bbc50cc4278409347d133cfdfe8f251e6627e533b669d740511c4527c3ecffc5cb2e76f46792fcb64b124c4b0115d9551968f7796431e4ef275705adabe
-
Filesize
26.0MB
MD50d8558b91333c2aa2489939e597c06f2
SHA18e0044c675537c48b8c25d38e9a777ce9b82ad37
SHA2563b6dc59df5d57f9ca457488a96118d310f380dd222ca462f63b3e8593e929973
SHA5129af991dafbf0d593b3278867e11fcb5290102e33c0a565cc783018d75cf85135e05527b22c17e73f97f278879457e44f5ea632b80836446b92c945016b0dd70d
-
Filesize
332KB
MD584be4a2606db0fdd27bfe810e367bac7
SHA1e9213c3d2753d828b792407d0a634118bc4963c3
SHA2567a49365c3a132d6b2a83a58952f7c777e4bde7d6bcab084b4112361182d8726d
SHA51263eb6225c483adebacfc94b0ef6afe10535354380f9a15c12e20dfb33e23523866dc2f365dfc880083d8c40cd415e0393d5c09bf13e09a2294f5699ef1d469df
-
Filesize
11KB
MD58fd89f82a273cd3ed2f76f7f09cf30ae
SHA143bb4e81acac468715e874ab86521497ca2e9369
SHA2568c9456aeacd5566234519b5b34ceecd0f7ebb22f6813747e595f5945517ec438
SHA512f77ad5dca3f72701ab2b779e900d22fa3f0c3ca6b8713e25bb7d6d1480992518d66879b6315122c555b32be527fef7c86ead1d59244c955287d48c3132b684f0
-
Filesize
2KB
MD577da079a3665afc84d05c3d07bcaa0d0
SHA13fbfafe2c08100f5b46b792398c2ecb9157760e9
SHA2561f6c35bc11d910f91c32ea54894d0fddb0094876bdd526d04a9287d04d636242
SHA51210fcd8464c6aab386bf2f675175598764e0b784a898b7b450fef3d055ecf902c7a57ac0aef2725b9e6899146e4e9230c8677bfd2a8f18489b642fa6beca25507
-
Filesize
90KB
MD56b0722f0b6ed86877d96da4a57f3aa03
SHA185cd52a10a8be6ca807fb5f6e180a1b1a1554583
SHA2562c2958dac6f36922ae094705e058bf6470e1622b31318fb9fe0db5457e383f45
SHA51274c399af44e982bb02eeb103bc634d2b5923b5623625a87bd148b6dad1afc438775a00ecbcdeeb2adb13d04c3b1d23a92cd9ee815c89f1af4fdbb3eb8fc3f49b
-
Filesize
11KB
MD571ecece58bb00bdc1e728ee28d7a5332
SHA14305889415cf95662a30d024f1138f1af224cf42
SHA256ee062e5ef2743ceab10c64830e4cefe52e35cc1ece85947ac4e61ddd1c0b05f7
SHA5129b23404d867fc4fd7c7beeba3768e8fed3113cc7430ec1bc9ca7faf6e6105388de7057b1402f9b4ba8fbc11e5fcd3afe14233721e8d15b6c0bed40f65aa5b58b
-
Filesize
40KB
MD51bb9772a05517e227d1dafd3936e8f66
SHA1d695ca5791a4b6a3509939aebdfaf5e229c6fbcf
SHA256581dcaace05d5c1ac9512457ff50565aca5d904d2c209bd3fc369ca4d4a0d2b1
SHA5123f1966038f91b887fe1a71474929bd87f3c75091846c6e9563f7424d3a7c19c908f1d874895341c61a868a616aba637e3d4188d4ebb7383087886a13a4dc0aa2
-
Filesize
473B
MD5f6719687bed7403612eaed0b191eb4a9
SHA1dd03919750e45507743bd089a659e8efcefa7af1
SHA256afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59
SHA512dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56
-
Filesize
984B
MD50359d5b66d73a97ce5dc9f89ed84c458
SHA1ce17e52eaac909dd63d16d93410de675d3e6ec0d
SHA256beeab2f8d3833839399dde15ce9085c17b304445577d21333e883d6db6d0b755
SHA5128fd94a098a4ab5c0fcd48c2cef2bb03328dd4d25c899bf5ed1ca561347d74a8aab8a214ba2d3180a86df72c52eb26987a44631d0ecd9edc84976c28d6c9dc16a
-
Filesize
1001B
MD52648d437c53db54b3ebd00e64852687e
SHA166cfe157f4c8e17bfda15325abfef40ec6d49608
SHA25668a3d7cb10f3001f40bc583b7fff0183895a61d3bd1b7a1c34e602df6f0f8806
SHA51286d5c3129bec156b17b8ebd5dec5a6258e10cb426b84dd3e4af85c9c2cd7ebf4faea01fd10dd906a18ea1042394c3f41a835eae2d83dc8146dfe4b6d71147828
-
Filesize
95B
MD5f86e3ac9b20bf37db69f2a917aaebfe2
SHA125eb7eb187fc2e47e96cd5baa85a4af3116931b6
SHA256d969393b6fd8b90148c998886bc4b9bb5bc600fa5916d9f4f883e40c68159ca0
SHA51260cee460d8eb72e4478eba37fae53b9c5e9d5812b3b569c965ea13eb8bfcd413a63ce52bf1b40462ccffca33d334eb7aadc32371e0746ac7cb4d6d63a2439407
-
Filesize
145B
MD5bbc03e9c7c5944e62efc9c660b7bd2b6
SHA183f161e3f49b64553709994b048d9f597cde3dc6
SHA2566cce5ad8d496bc5179fa84af8afc568eeba980d8a75058c6380b64fb42298c28
SHA512fb80f091468a299b5209acc30edaf2001d081c22c3b30aad422cbe6fea7e5fe36a67a8e000d5dd03a30c60c30391c85fa31f3931e804c351ab0a71e9a978cc0f
-
Filesize
73B
MD5697923f81433877a1a04eb11732875cc
SHA16d9be7b5a1a8a6ee1c3e8951c3ba70639aabea33
SHA256cae294484d0aeed7138060cc5b672e34901f48dea5ac7e5a78a8de5217aab981
SHA512fde036b7da901864b89ff838c37d05ef347f95f8ac8ec74908419ac6a3b68bbb87c7bbec7fd129c523370b9d33c2b618e442ed020945d78240c61a528dbe35ed
-
Filesize
72B
MD535abc0d40a8a6f05b7cb24f83f31f32f
SHA1e64f0e81892656a87d7a90a558948ac1291411cd
SHA256f4eb5b805c70c657d3aac2bb6d076e21b08366032704c93c18cb27ccb09d76bb
SHA51292ea93006b86771ec1d5a0f3fc8523c94601fe30ca762b6d56fb7232dfbee417ad4f1cdcbd24fdad7691bab57944dbf27d64732cabd003510f0af0e4aab5c0f0
-
Filesize
7KB
MD56f5ffb58a9e406ab1643c890e2a198c6
SHA13ff1faba00ac18a93e88a6f2bbfa747c9fdc7e0c
SHA2561327ab3a8c50691f04bea8e2ca356c5b604092a719e219464f8cc4b42e192de9
SHA512af29bc13cc02238208c51e4e95dd0a4445a952755635a9eab38aa77a5c087cc8e2025af55d8f3a0e9f2430baa91534e7f892bb71aa0ef72bab4483211a845b4b
-
Filesize
4KB
MD59eb0320dfbf2bd541e6a55c01ddc9f20
SHA1eb282a66d29594346531b1ff886d455e1dcd6d99
SHA2569095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
SHA5129ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
-
C:\Windows\Temp\{492F0F5D-6C6A-40F6-A0AD-099D4D250B2A}\.be\windowsdesktop-runtime-6.0.26-win-x86.exe
Filesize610KB
MD5c11e43cbff11161bd30606b34ec53b5a
SHA14777d18990281636207fac89d6d1023a5195d21d
SHA2564b159537e29c9ea644c91a4ebf0724b43a8b1b1e70d23445f28cdf6a3154650d
SHA51243451b66da1fb53b6f8441ca7789564c86665f57682b5bd85f68ce8232b654aa66dcd397ec8412e38ef75ada11e49a139815ee4e787c90e7ad0212676a439894