neshta | 47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
Size

8.0MB
MD5

672f20e0888c88b5b086e9f5a3060470
SHA1

02a8980c21d82accc2d46e3ce3ae2a8751760b70
SHA256

47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456
SHA512

d4fd81517c33d9553cd63c850347bb9ba83f9c070169b0d52b6bb6063fdf549f7fe21d5a33fc956eb04d5d0e64c7b2a32b56028094cf958677cb2f12b56dfa23
SSDEEP

98304:Cmtk2aJmtk2aVmtk2aGmtk2aVWW8iYgdTl3Z6FTwpNgV9pNYrTtRaVyjEHRrnhby:RN1cqWWEKZ8Um3qT58ndrIaC2wak9

Score

10^/10

neshta xred backdoor discovery persistence spyware upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta
Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe._cache_47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	._cache_47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

Executes dropped EXE 2 IoCs

Processes:

47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe._cache_47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

pid	process
3512	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
3992	._cache_47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

UPX packed file 31 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\3582-490\._cache__C578E~1.EXE	upx
behavioral2/memory/400-757-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/948-759-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/2096-770-0x0000000000480000-0x0000000000A3B000-memory.dmp	upx
behavioral2/memory/2096-777-0x0000000000480000-0x0000000000A3B000-memory.dmp	upx
behavioral2/memory/2480-789-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/3056-826-0x0000000000500000-0x0000000000ABB000-memory.dmp	upx
behavioral2/memory/3056-832-0x0000000000500000-0x0000000000ABB000-memory.dmp	upx
behavioral2/memory/400-833-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/948-855-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/1520-860-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/4652-868-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/2480-875-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/2908-942-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/1520-995-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/4652-1163-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/2988-1252-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/404-1257-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/4920-1272-0x00000000002F0000-0x00000000008AB000-memory.dmp	upx
behavioral2/memory/1792-1268-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/4920-1274-0x00000000002F0000-0x00000000008AB000-memory.dmp	upx
behavioral2/memory/2448-1284-0x00000000007C0000-0x0000000000D7B000-memory.dmp	upx
behavioral2/memory/2448-1278-0x00000000007C0000-0x0000000000D7B000-memory.dmp	upx
behavioral2/memory/2312-1308-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/2988-1334-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/400-1523-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/4676-1521-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/1820-1532-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/4676-1567-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/2012-1690-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx
behavioral2/memory/2012-2128-0x0000000000DB0000-0x000000000136B000-memory.dmp	upx

Drops file in Program Files directory 14 IoCs

Processes:

47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

Drops file in Windows directory 1 IoCs

Processes:

47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

description ioc process

File opened for modification C:\Windows\svchost.com 47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

Modifies registry class 2 IoCs

Processes:

47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

description	pid	process	target process
PID 2460 wrote to memory of 3512	2460	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
PID 2460 wrote to memory of 3512	2460	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
PID 2460 wrote to memory of 3512	2460	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
PID 3512 wrote to memory of 3992	3512	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe	._cache_47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
PID 3512 wrote to memory of 3992	3512	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe	._cache_47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
PID 3512 wrote to memory of 3992	3512	47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe	._cache_47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

C:\Users\Admin\AppData\Local\Temp\47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
"C:\Users\Admin\AppData\Local\Temp\47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Users\Admin\AppData\Local\Temp\3582-490\47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Users\Admin\AppData\Local\Temp\._cache_47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3992
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE"
      4⤵
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        5⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE"
        6⤵
        
        PID:3436
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE"
        7⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
        8⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE"
        9⤵
        
        PID:4212
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE"
        10⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        11⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE"
        12⤵
        
        PID:1708
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE"
        13⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
        14⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE"
        15⤵
        
        PID:3488
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache__CACHE~2.EXE"
        16⤵
        
        PID:2828
      - C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        6⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        7⤵
        
        PID:3420
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate
        8⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate
        9⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate
        10⤵
        
        PID:2660
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
        11⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
        12⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate
        13⤵
        
        PID:4080
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate
        14⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate
        15⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate
        16⤵
        
        PID:4012
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
        17⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
        18⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=107.0.5045.30 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x71cb61e4,0x71cb61f0,0x71cb61fc
        19⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\_CACHE~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\_CACHE~1.EXE" --version
        19⤵
        
        PID:3056
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        16⤵
        
        PID:456
        
        C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        17⤵
        
        PID:1912
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate
        18⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate
        19⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate
        20⤵
        
        PID:3928
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
        21⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
        22⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate
        23⤵
        
        PID:744
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate
        24⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate
        25⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate
        26⤵
        
        PID:3812
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
        27⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
        28⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=107.0.5045.30 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2bc,0x2ec,0x71cb61e4,0x71cb61f0,0x71cb61fc
        29⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\_CACHE~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\_CACHE~1.EXE" --version
        29⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2988 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241124210158" --session-guid=3bb39eba-c86b-49b2-8e09-5cbc2308220a --server-tracking-blob="NGViMjhmMGY4OTUxMDI3NjZiMzBhM2JjNmY2YzM4YmM5ZTNkNzYzYmE5NGE4ZWM2MzA5MDg4NWU4YmExNjAxZTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMSIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6eyJuYW1lIjoib3BlcmFfZ3gifSwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMSZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9VU19NVlJfRERfMjY4JmVkaXRpb249c3RkLTEmdXRtX2NvbnRlbnQ9MjY4X2xvb3RsYWJzJnV0bV9pZD05YmExZmVlMzViZjY0OGEzOWIyNmM2M2E0NTU4NDQ1ZiZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRmdldCUyRm9wZXJhLWd4JTNGdXRtX2NvbnRlbnQlM0QyNjhfbG9vdGxhYnMlMjZ1dG1fc291cmNlJTNEUFdOZ2FtZXMlMjZ1dG1fbWVkaXVtJTNEcGElMjZ1dG1fY2FtcGFpZ24lM0RQV05fVVNfTVZSX0REXzI2OCUyNnV0bV9pZCUzRDliYTFmZWUzNWJmNjQ4YTM5YjI2YzYzYTQ1NTg0NDVmJTI2ZWRpdGlvbiUzRHN0ZC0xJnV0bV9zaXRlPW9wZXJhX2NvbSZ1dG1fbGFzdHBhZ2U9b3BlcmEuY29tJTJGZ2V0JTJGb3BlcmEtZ3gmdXRtX2lkPTliYTFmZWUzNWJmNjQ4YTM5YjI2YzYzYTQ1NTg0NDVmJmRsX3Rva2VuPTczNDI1NjcxIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzA4OTkxOTM2LjE4MzkiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fVVNfTVZSX0REXzI2OCIsImNvbnRlbnQiOiIyNjhfbG9vdGxhYnMiLCJpZCI6IjliYTFmZWUzNWJmNjQ4YTM5YjI2YzYzYTQ1NTg0NDVmIiwibGFzdHBhZ2UiOiJvcGVyYS5jb20vZ2V0L29wZXJhLWd4IiwibWVkaXVtIjoicGEiLCJzaXRlIjoib3BlcmFfY29tIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImQ1NjEyMjJjLTViOTctNGMyNi1hZTQ0LTA3Y2ZmMWQyN2RkZiJ9 " --desktopshortcut=1 --wait-for-package --initial-proc-handle=4808000000000000
        29⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=107.0.5045.30 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2bc,0x2f8,0x730c61e4,0x730c61f0,0x730c61fc
        30⤵
        
        PID:1820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
        29⤵
        
        PID:3016
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe" --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
        30⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
        31⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411242101581\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411242101581\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
        29⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411242101581\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411242101581\assistant\assistant_installer.exe" --version
        29⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411242101581\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411242101581\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x784f48,0x784f58,0x784f64
        30⤵
        
        PID:5844
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        26⤵
        
        PID:2680
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        23⤵
        
        PID:4412
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        20⤵
        
        PID:1912
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        13⤵
        
        PID:3148
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        10⤵
        
        PID:2760
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        10⤵
        
        PID:2304
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
      4⤵
      PID:3864
    - - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate
        5⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate
        6⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate
        7⤵
        
        PID:956
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
        8⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
        9⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate
        10⤵
        
        PID:3432
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate
        11⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate
        12⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate
        13⤵
        
        PID:3296
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
        14⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
        15⤵
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=107.0.5045.30 --initial-client-data=0x2c0,0x2e4,0x2e8,0x24c,0x2ec,0x730c61e4,0x730c61f0,0x730c61fc
        16⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\_CACHE~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\_CACHE~1.EXE" --version
        16⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=400 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241124210123" --session-guid=926ca31f-2435-4c13-9ae7-85e7ea2ef9d9 --server-tracking-blob="NGViMjhmMGY4OTUxMDI3NjZiMzBhM2JjNmY2YzM4YmM5ZTNkNzYzYmE5NGE4ZWM2MzA5MDg4NWU4YmExNjAxZTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMSIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6eyJuYW1lIjoib3BlcmFfZ3gifSwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMSZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9VU19NVlJfRERfMjY4JmVkaXRpb249c3RkLTEmdXRtX2NvbnRlbnQ9MjY4X2xvb3RsYWJzJnV0bV9pZD05YmExZmVlMzViZjY0OGEzOWIyNmM2M2E0NTU4NDQ1ZiZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRmdldCUyRm9wZXJhLWd4JTNGdXRtX2NvbnRlbnQlM0QyNjhfbG9vdGxhYnMlMjZ1dG1fc291cmNlJTNEUFdOZ2FtZXMlMjZ1dG1fbWVkaXVtJTNEcGElMjZ1dG1fY2FtcGFpZ24lM0RQV05fVVNfTVZSX0REXzI2OCUyNnV0bV9pZCUzRDliYTFmZWUzNWJmNjQ4YTM5YjI2YzYzYTQ1NTg0NDVmJTI2ZWRpdGlvbiUzRHN0ZC0xJnV0bV9zaXRlPW9wZXJhX2NvbSZ1dG1fbGFzdHBhZ2U9b3BlcmEuY29tJTJGZ2V0JTJGb3BlcmEtZ3gmdXRtX2lkPTliYTFmZWUzNWJmNjQ4YTM5YjI2YzYzYTQ1NTg0NDVmJmRsX3Rva2VuPTczNDI1NjcxIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzA4OTkxOTM2LjE4MzkiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fVVNfTVZSX0REXzI2OCIsImNvbnRlbnQiOiIyNjhfbG9vdGxhYnMiLCJpZCI6IjliYTFmZWUzNWJmNjQ4YTM5YjI2YzYzYTQ1NTg0NDVmIiwibGFzdHBhZ2UiOiJvcGVyYS5jb20vZ2V0L29wZXJhLWd4IiwibWVkaXVtIjoicGEiLCJzaXRlIjoib3BlcmFfY29tIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImQ1NjEyMjJjLTViOTctNGMyNi1hZTQ0LTA3Y2ZmMWQyN2RkZiJ9 " --desktopshortcut=1 --wait-for-package --initial-proc-handle=2C09000000000000
        16⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=107.0.5045.30 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2bc,0x2f8,0x70c561e4,0x70c561f0,0x70c561fc
        17⤵
        
        PID:4652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
        16⤵
        
        PID:2828
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe" --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
        17⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
        18⤵
        
        PID:4752
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        13⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        14⤵
        
        PID:1848
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate
        15⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate
        16⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate
        17⤵
        
        PID:2312
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
        18⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
        19⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate
        20⤵
        
        PID:528
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate
        21⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate
        22⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate
        23⤵
        
        PID:668
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
        24⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
        25⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=107.0.5045.30 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2c4,0x2f4,0x70c561e4,0x70c561f0,0x70c561fc
        26⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\.opera\Opera GX Installer Temp\_CACHE~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\3582-490\.opera\Opera GX Installer Temp\_CACHE~1.EXE" --version
        26⤵
        
        PID:2448
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        23⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        24⤵
        
        PID:1956
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
        25⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
        26⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
        27⤵
        
        PID:1604
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate
        28⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate
        29⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate
        30⤵
        
        PID:1648
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
        31⤵
        
        PID:116
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
        32⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate
        33⤵
        
        PID:4008
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate
        34⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate
        35⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate
        36⤵
        
        PID:1204
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
        37⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
        38⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=107.0.5045.30 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2bc,0x2ec,0x730c61e4,0x730c61f0,0x730c61fc
        39⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\_CACHE~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\_CACHE~1.EXE" --version
        39⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2012 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241124210228" --session-guid=6ee04cb5-c014-44dd-85ab-ed403ce48de4 --server-tracking-blob="NGViMjhmMGY4OTUxMDI3NjZiMzBhM2JjNmY2YzM4YmM5ZTNkNzYzYmE5NGE4ZWM2MzA5MDg4NWU4YmExNjAxZTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMSIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6eyJuYW1lIjoib3BlcmFfZ3gifSwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMSZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9VU19NVlJfRERfMjY4JmVkaXRpb249c3RkLTEmdXRtX2NvbnRlbnQ9MjY4X2xvb3RsYWJzJnV0bV9pZD05YmExZmVlMzViZjY0OGEzOWIyNmM2M2E0NTU4NDQ1ZiZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRmdldCUyRm9wZXJhLWd4JTNGdXRtX2NvbnRlbnQlM0QyNjhfbG9vdGxhYnMlMjZ1dG1fc291cmNlJTNEUFdOZ2FtZXMlMjZ1dG1fbWVkaXVtJTNEcGElMjZ1dG1fY2FtcGFpZ24lM0RQV05fVVNfTVZSX0REXzI2OCUyNnV0bV9pZCUzRDliYTFmZWUzNWJmNjQ4YTM5YjI2YzYzYTQ1NTg0NDVmJTI2ZWRpdGlvbiUzRHN0ZC0xJnV0bV9zaXRlPW9wZXJhX2NvbSZ1dG1fbGFzdHBhZ2U9b3BlcmEuY29tJTJGZ2V0JTJGb3BlcmEtZ3gmdXRtX2lkPTliYTFmZWUzNWJmNjQ4YTM5YjI2YzYzYTQ1NTg0NDVmJmRsX3Rva2VuPTczNDI1NjcxIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzA4OTkxOTM2LjE4MzkiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fVVNfTVZSX0REXzI2OCIsImNvbnRlbnQiOiIyNjhfbG9vdGxhYnMiLCJpZCI6IjliYTFmZWUzNWJmNjQ4YTM5YjI2YzYzYTQ1NTg0NDVmIiwibGFzdHBhZ2UiOiJvcGVyYS5jb20vZ2V0L29wZXJhLWd4IiwibWVkaXVtIjoicGEiLCJzaXRlIjoib3BlcmFfY29tIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImQ1NjEyMjJjLTViOTctNGMyNi1hZTQ0LTA3Y2ZmMWQyN2RkZiJ9 " --desktopshortcut=1 --wait-for-package --initial-proc-handle=D807000000000000
        39⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=107.0.5045.30 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2bc,0x2f8,0x6ee161e4,0x6ee161f0,0x6ee161fc
        40⤵
        
        PID:5552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
        39⤵
        
        PID:5936
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe" --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
        40⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
        41⤵
        
        PID:5308
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        36⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        37⤵
        
        PID:1712
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
        38⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
        39⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
        40⤵
        
        PID:5828
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate
        41⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate
        42⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate
        43⤵
        
        PID:5712
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
        44⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
        45⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate
        46⤵
        
        PID:608
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate
        47⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate
        48⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate
        49⤵
        
        PID:5544
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
        50⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
        51⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=107.0.5045.30 --initial-client-data=0x2e0,0x2e4,0x2e8,0x240,0x2ec,0x6e3761e4,0x6e3761f0,0x6e3761fc
        52⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\_CACHE~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\_CACHE~1.EXE" --version
        52⤵
        
        PID:1580
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        49⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        50⤵
        
        PID:608
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
        51⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
        52⤵
        
        PID:5312
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        43⤵
        
        PID:5492
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        43⤵
        
        PID:5444
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        40⤵
        
        PID:5328
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        33⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        34⤵
        
        PID:5068
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
        35⤵
        
        PID:116
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
        36⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
        37⤵
        
        PID:1632
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate
        38⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate
        39⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate
        40⤵
        
        PID:5780
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
        41⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
        42⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate
        43⤵
        
        PID:5616
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate
        44⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate
        45⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate
        46⤵
        
        PID:6068
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
        47⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
        48⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=107.0.5045.30 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2bc,0x2ec,0x730c61e4,0x730c61f0,0x730c61fc
        49⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\_CACHE~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\_CACHE~1.EXE" --version
        49⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=5132 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241124210248" --session-guid=12d66702-2d8c-46db-ac24-19e2c9c36c63 --server-tracking-blob="NGViMjhmMGY4OTUxMDI3NjZiMzBhM2JjNmY2YzM4YmM5ZTNkNzYzYmE5NGE4ZWM2MzA5MDg4NWU4YmExNjAxZTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMSIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6eyJuYW1lIjoib3BlcmFfZ3gifSwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMSZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9VU19NVlJfRERfMjY4JmVkaXRpb249c3RkLTEmdXRtX2NvbnRlbnQ9MjY4X2xvb3RsYWJzJnV0bV9pZD05YmExZmVlMzViZjY0OGEzOWIyNmM2M2E0NTU4NDQ1ZiZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRmdldCUyRm9wZXJhLWd4JTNGdXRtX2NvbnRlbnQlM0QyNjhfbG9vdGxhYnMlMjZ1dG1fc291cmNlJTNEUFdOZ2FtZXMlMjZ1dG1fbWVkaXVtJTNEcGElMjZ1dG1fY2FtcGFpZ24lM0RQV05fVVNfTVZSX0REXzI2OCUyNnV0bV9pZCUzRDliYTFmZWUzNWJmNjQ4YTM5YjI2YzYzYTQ1NTg0NDVmJTI2ZWRpdGlvbiUzRHN0ZC0xJnV0bV9zaXRlPW9wZXJhX2NvbSZ1dG1fbGFzdHBhZ2U9b3BlcmEuY29tJTJGZ2V0JTJGb3BlcmEtZ3gmdXRtX2lkPTliYTFmZWUzNWJmNjQ4YTM5YjI2YzYzYTQ1NTg0NDVmJmRsX3Rva2VuPTczNDI1NjcxIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzA4OTkxOTM2LjE4MzkiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fVVNfTVZSX0REXzI2OCIsImNvbnRlbnQiOiIyNjhfbG9vdGxhYnMiLCJpZCI6IjliYTFmZWUzNWJmNjQ4YTM5YjI2YzYzYTQ1NTg0NDVmIiwibGFzdHBhZ2UiOiJvcGVyYS5jb20vZ2V0L29wZXJhLWd4IiwibWVkaXVtIjoicGEiLCJzaXRlIjoib3BlcmFfY29tIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImQ1NjEyMjJjLTViOTctNGMyNi1hZTQ0LTA3Y2ZmMWQyN2RkZiJ9 " --desktopshortcut=1 --wait-for-package --initial-proc-handle=5408000000000000
        49⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=107.0.5045.30 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2bc,0x2f8,0x6e3761e4,0x6e3761f0,0x6e3761fc
        50⤵
        
        PID:5356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
        49⤵
        
        PID:2820
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        46⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        47⤵
        
        PID:628
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
        48⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
        49⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
        50⤵
        
        PID:5480
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate
        51⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate
        52⤵
        
        PID:1956
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        50⤵
        
        PID:5864
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        43⤵
        
        PID:5236
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        43⤵
        
        PID:5316
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        40⤵
        
        PID:6012
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        37⤵
        
        PID:5488
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        30⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        31⤵
        
        PID:620
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
        32⤵
        
        PID:5020
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        27⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        28⤵
        
        PID:1972
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
        29⤵
        
        PID:1256
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        20⤵
        
        PID:3644
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        17⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        18⤵
        
        PID:3124
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_Synaptics.exe" InjUpdate
        19⤵
        
        PID:3452
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        10⤵
        
        PID:1208
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        7⤵
        
        PID:4384

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
PID:2248

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
PID:3328

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
PID:1272

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
PID:4780

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
PID:4384

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
PID:1972

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
PID:3032

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
PID:5564

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
PID:5440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE

Filesize
328KB

MD5
114445130d5e083c42830d9adbf5d748

SHA1
48a62ec52b835918cc19a2df9c624a7a0d6b85e1

SHA256
a5f47d59b8d08fc85ee411ec2e1015fedda08fd4a6cae2bf7b3bb1a7db2ccb5e

SHA512
45eb73fd4e12ed70c386c733b2bc04296fb1a16be04b4cd45260c70d0e4b6cf3a87dc223ce2319d94b79c513ba19d0816bae428c466076c1de906429aaa78748

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

Filesize
86KB

MD5
ef63e5ccbea2788d900f1c70a6159c68

SHA1
4ac2e144f9dd97a0cd061b76be89f7850887c166

SHA256
a46d1ffbe9114015050b2a778859c26248f8bab22d5d1a302b59373bc20c6b45

SHA512
913371abb54e0adc94aa08372a20f07ced9f9fdc170f9e468cd39c7387c7e30c1ae238148ccf355d5c8b88b7fd63f914bb108c6cafca9a791d02d8b36468bfac

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE

Filesize
5.7MB

MD5
3e4c1ecf89d19b8484e386008bb37a25

SHA1
a9a92b63645928e8a92dc395713d3c5b921026b7

SHA256
1ebe469c94c2c2a5acbc3927cef19dbe2f583ba3651a55623633891c4c05cc22

SHA512
473d03abbb61609749a176a0724e427599a4f4707d72a74ed457b2198098f59fdf64b5394798db82f4064dfe964083d70af6a50a5fa2ab2674c77a99792e4e52

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe

Filesize
175KB

MD5
3da833f022988fbc093129595cc8591c

SHA1
fdde5a7fb7a60169d2967ff88c6aba8273f12e36

SHA256
1ad4c736829dbcb0fcc620fd897fe0941b9c01e14ccba5d18085b3ca0416ab66

SHA512
1299d63337c958e8072d6aaa057904cbbaa51c2eec4457269ead6b72c4eb2a10882e4a5dc7afcdcab5a6910d2105c2e5ee706850074e0425ae7f87d9ea1e5537

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe

Filesize
9.4MB

MD5
124147ede15f97b47224628152110ce2

SHA1
4530fee9b1199777693073414b82420a7c88a042

SHA256
3e815d583236b9cecd912fcc949a301d1e51b609cbb53a2285d08feea305edcd

SHA512
f4c2825380d1bb9ca889d5c5684f13aa0cacb0d6511f6409ca0972a7191195a0175e00c995407848bf09ea03cff05c7395952bf2ffd2af2015b8939f75a8e627

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

Filesize
2.4MB

MD5
d9e8a1fa55faebd36ed2342fedefbedd

SHA1
c25cc7f0035488de9c5df0121a09b5100e1c28e9

SHA256
bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a

SHA512
134644c68bd04536e9ea0a5da6e334d36b1ce8012a061fa6dabd31f85c16a1ac9eee8c40fee3d55f25c4d4edf0672de8ce204e344c800361cbcff092c09d7a33

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE

Filesize
183KB

MD5
4ab023aa6def7b300dec4fc7ef55dbe7

SHA1
aa30491eb799fa5bdf79691f8fe5e087467463f1

SHA256
8ca27077312716f79f39309156c905719a908e8ded4bf88c2ba6fa821e574673

SHA512
000e33cc2399efa9dc56c06a42f91eb64b94f30b78cf260469f45f3b876f518d2d2b62e33d8f697660ae560d595e5bd5b7a5f847c316d5f97adeb3d8f9248ab5

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe

Filesize
131KB

MD5
514972e16cdda8b53012ad8a14a26e60

SHA1
aa082c2fbe0b3dd5c47952f9a285636412203559

SHA256
49091e1e41980b39d8de055fe6c6a1dc69398f17817960d64743e7efb740efc4

SHA512
98bbd6f06e3ff3e94aee3620f20f89e254dde157bc8129a64cf78fefe5cf9b13c7902128c2acbd54b3def527e09a039bd1f66ba64efb85f3f0404d894cabbee4

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE

Filesize
254KB

MD5
c4a918069757a263adb9fbc9f5c9e00d

SHA1
66d749fc566763b6170080a40f54f4cda4644af4

SHA256
129a2bfe25ceabb871b65b645ef98f6799d7d273fc5ddfd33c1cb78f5b76fa3b

SHA512
4ecf32fa2c8f53ff7a08555ec5d37739dc1358352621d038669f608edf18b0dcc6dca168a2b602359c9ee098052e546e5c02603f83aad44a114192138de7b7b9

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE

Filesize
386KB

MD5
2e989da204d9c4c3e375a32edf4d16e7

SHA1
e8a0bf8b4ae4f26e2af5c1748de6055ba4308129

SHA256
cae320401aa01a3cef836c191c2edbd7a96bfcce9efad1a21880626a64cc4dec

SHA512
3ebf71578bef909d9411c131d0ccd38ead68cba01a8e0f845d08faa012ca2136476fe09a2859ed846641f80b7a2d9b78d49c709065a52c6b9ee149edf84c8c4f

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE

Filesize
92KB

MD5
3e8712e3f8ce04d61b1c23d9494e1154

SHA1
7e28cd92992cdee55a02b5ece4b7c2fc4dd0c5e4

SHA256
7a8ee09f8a75b3e812f99a0b611c6720626c62c6985306a408694389a996c8e9

SHA512
d07d924f338bd36ca51c8e11931f7ff069e65942725a8e1f1ff6b81076a987ab7d787452a5fb08314edf1489e081f4164db1ad299a6d78401e630796f4487dc8

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE

Filesize
147KB

MD5
dc6f9d4b474492fd2c6bb0d6219b9877

SHA1
85f5550b7e51ecbf361aaba35b26d62ed4a3f907

SHA256
686bec325444e43232fb20e96365bb1f1eb7c47a4e4ce246fc900d3a9784d436

SHA512
1e9c2dfeada91e69ee91cd398145e4044bd5788a628b89441c8c6ff4067ba0a399124197fd31dad26ccb76a4d866ad99918ba8e1549983be967d31b933ad9780

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe

Filesize
125KB

MD5
66a77a65eea771304e524dd844c9846a

SHA1
f7e3b403439b5f63927e8681a64f62caafe9a360

SHA256
9a7391267ab83b45a47d9fcf1e0f76002ed6640ed6a574ba51373410b94812f6

SHA512
3643ad1036075305d76dfd753b1ed29ae611b4b9f397b2520f95b1487e85155a111adc83578db8ca5d0fd1e9fe146d018e22f572c187ef468eab8d11d48fc7f4

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE

Filesize
142KB

MD5
3ccfc6967bcfea597926999974eb0cf9

SHA1
6736e7886e848d41de098cd00b8279c9bc94d501

SHA256
a89d3e2109a8e35e263da363d3551258ea320a99bfb84a4b13ad563008eda8d9

SHA512
f550af4e053d89eff45c0fb00bb32e8d212645a155727d3536a3f12bb0b5550bed25516516334245b912fa4fc2e4e7c267e80da4f06d22ea128f20eb56ab4351

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE

Filesize
278KB

MD5
823cb3e3a3de255bdb0d1f362f6f48ab

SHA1
9027969c2f7b427527b23cb7ab1a0abc1898b262

SHA256
b8c5b99365f5ac318973b151fe3fe2a4ad12546371df69e1b7d749f7a4ce356f

SHA512
0652b60e07aa5a469b9cf1013a1ed98d0352996c59b9a66f612be2bc0081d8ec8a65a44a3977d2e188cd8ee3311edb251b818cf300d152ed5f633679a6cf834c

Download Submit
C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE

Filesize
454KB

MD5
961c73fd70b543a6a3c816649e5f8fce

SHA1
8dbdc7daeb83110638d192f65f6d014169e0a79b

SHA256
f94ddaf929fb16d952b79c02e78439a10dd2faa78f7f66b7d52de2675e513103

SHA512
e5d97ee63b02abc65add41f6721514515b34fd79f7db23ae04cf608c2f7e0504e00b07694047b982d14d60cccf6f833b50268c693e3baf1b697d3370c0bba0b6

Download Submit
C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe

Filesize
1.2MB

MD5
e115eb174536d5fbcf5164232c89c25d

SHA1
5879354de61734962d39d13316d1fe028389cc16

SHA256
57329b38314923c17e9dd9e153e894708389dd597fcb1438d5291c7627238653

SHA512
69696a2e842e0557a57ec4d12c31d5afde0cdfb80d6028ad8d9b0b59d558ad6eaf043c9da0d31c43b16b4f12894dcea69db9366772c49c758773e6c35a9fb0c5

Download Submit
C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe

Filesize
555KB

MD5
ead399a43035cf6544c96d014436fc9a

SHA1
c8ef64abb6c56cbd02e851a98214620459c8b947

SHA256
38b06ee250af6554e6740a1bb7acfb77b99ccdb8081880e01c386afa98668766

SHA512
6fa46a36c17c9496c18843e04d78d5146cdea173a74acacd9b7c63d220c49fa3a1acb65f91fe7214a1ae82ebf63fb5366beecd7f9e0aeee0cbab5d1bd0aa6d14

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE

Filesize
121KB

MD5
6b27dd3f7c6898e7d1bcff73d6e29858

SHA1
55102c244643d43aeaf625145c6475e78dfbe9de

SHA256
53e47df12f0ce2005f4a2a773d194c9431b325b64c205dfa4cfba45c973b65f3

SHA512
52b7a596b07935f15f008c2de38c5dfd85df18b49e5083e363b90fb321d4f1bf588627dcbe94fa6434c460243b254c5ca1dbcf2c956e49baa92e13e104500f2f

Download Submit
C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe

Filesize
325KB

MD5
62976c65ded41b4f31c7f379c548e05c

SHA1
3827c414ad15cd67ea8635400002c4c79704250e

SHA256
80de06ea5d221e21f765a96750f821aaaf8eee23bfd9d8cde265a8da11041c66

SHA512
ddf74814c7a54a258b7200310bd644547f3a831e373c8392dddedd08b3c1ca60e864fbe2007e68fabdcfe1e923d9207039bde42a09e0ec07d69694263057fcd7

Download Submit
C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe

Filesize
325KB

MD5
de9e6086062f01926b48c2d80508d12b

SHA1
13610cca5e38925e22b6a79067df0dd9eca49fe3

SHA256
d2f956514bc885fed054dec3ad4c0e89e59a6a38390fa8432abd15eb201468b4

SHA512
60478e55b6a3d49686ed8e95e939a2384fb1440950d710e7beedb9eda24be0e6996c931d0703d6cc0065fbe5a85eff463b9e9eaadf14746593abe723636137c3

Download Submit
C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe

Filesize
505KB

MD5
7aac73055860fcd079d9407cab08276d

SHA1
482b9f337d60270c95950353f9ca8929d8926b1d

SHA256
97508a81b805937e1ca57711a51d2e8d715a2748e2f9d27d39dfecc28f3fb9e5

SHA512
f183a10eb13c083c7cd8e785a7978eee4998c33d1eb104a0ab0e54146e10651f68612249e668baa08919a5840f6f929b5452c93f71a232b30aab9e2857109fb5

Download Submit
C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE

Filesize
146KB

MD5
6ecccb4bab82a4971897aa0bcb2f14be

SHA1
1c680d6f8ca6a0436b5935906a2d9c4699a7a412

SHA256
c661a1408b32f837e02965675400807e111dc5d43a00588011e4365dd3c24be1

SHA512
d68cae4b3c7664751bca1f73cb6b6aa0f0745bb10a76e250b9ffae82bbf2a398f17277ebe5cfd22338af9b4d4c0e0c8241eeb640bdcc0a73774612a6785ac081

Download Submit
C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE

Filesize
221KB

MD5
a12297c17e3747647d5c29d67edd4d9a

SHA1
6a6ed9d50d8385b2fb1da6c700934bf213e1ec2d

SHA256
288f7e376d1ba967276a05a1b00fddff236315ee0df24e543cf8b604768ae7f2

SHA512
e1004b5307f26af7c22ec051539ed633105ac6673301d31a57cb530ab76551b51aa59741397d1b9fe860bed8c93c2a21d8e828edd1612750bcec1bd068898239

Download Submit
C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE

Filesize
146KB

MD5
001760b2a66fb4fff1e2c42bc39e5421

SHA1
1980cafc246e5a31b6e78bcd5eec1726c9789046

SHA256
1ae63f874694d576e6b6c2f409a71e49cf607e62b2a7a646322294009c7b813a

SHA512
a37e499451abc2b9399eafe8d866210bdaac2c73a4f1dbe16c272fa56a8b5bcb1efe41e198effb9c84a77de269cbb5b81871d88eb726f95c3d3b4067bfc0c7df

Download Submit
C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE

Filesize
258KB

MD5
78f77aff4993684fdbcad13c74d5f364

SHA1
0b02ed9112021b3c65778fdce0642e81dfb5b628

SHA256
9f707deff2f5b5a8c611c5926362c4ffc82f5744a4699f3fb1ee3ef6bb9b2cfb

SHA512
568c1abf5f6d13fe37cb55a5f5992dea38e30fc80812a977c0ae25ed30f67321db8f4c0da2ae4ae558e58dc430885fa13c1f7f1d6b2d6bb51ed031f042defafb

Download Submit
C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE

Filesize
335KB

MD5
48628eeb152032e8dc9af97aaaeba7cf

SHA1
e826f32c423627ef625a6618e7250f7dbc4d2501

SHA256
f271af83d96b1d536e1a1788ec0baa0c3c583ddfe61faceccaeec1470c5676ca

SHA512
18a2a247177d04d5b1b56d126d72e29b02c8378e8aa4c89bdbaefe14bcd577d7aa054b05a5db37d142a37cf869f3bc03fe9a5bba4886a52d6c2ede5052dfcc7d

Download Submit
C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE

Filesize
433KB

MD5
b6283a7eb554d995d9a7c72dcfca14b5

SHA1
67d64907800c611bbcefd31d2494da12962f5022

SHA256
099da4830adbab785d86ca4680c041458acfe798ed8b301b2bb6bd47891ed881

SHA512
a6d96a13b8672d0f1d50ac22ba95b715527050ce91bb67dc261732e0a114ef2902e3380577546ff34860f65723a143153cea47ae31e12bb27dd3f4f5ee2245f3

Download Submit
C:\PROGRA~2\Google\Update\DISABL~1.EXE

Filesize
198KB

MD5
2424d589d7997df1356c160a9a82088c

SHA1
ca9b479043636434f32c74c2299210ef9f933b98

SHA256
9d6982a566148cf69cb6aec417baddca680e647931315736a6c19f2ba91c4d60

SHA512
4dd0a69c1dfb0e88fc6b24c97e14dd0ad1ac0226dd372d09123b6a2ec3c107fc94a810764d16e111d1cf7e81a23b70b84d36cbfbf1e32986d00de3cd9e315c2b

Download Submit
C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE

Filesize
139KB

MD5
415671ceca4f8e9fd6830ba812e41597

SHA1
0e5095e00711a69d44bfff529a8700528093ca52

SHA256
235bea563512a5532851bd2b1b2927cc0365904e1f851d7d94010b65e531092b

SHA512
ccafc59de0d100fc54d4099fd07b83e8a4d962e12bcecc3d1145ab41edc89bb3a5b9f3a00cc4d9df57bd7784666da7c00effc11cc5b991f9f97587cb8affeee8

Download Submit
C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE

Filesize
1.7MB

MD5
619314ef3e2e5abde1bb19dbce363220

SHA1
5fc9e9c74d8fdc9d185f524dc1364500883c4eef

SHA256
763c48c14695500dd1f8b1b88f7be84a9fe95d9a7bb63211f74cbe210e0a58af

SHA512
5389516629a884b109950254398d1453fd573ce6f73ff3479322c1361ec990b53cd0cec2fbe366e7ab0ba704bfb1f5fd58dc7ec3d81254c9256973f4983ec360

Download Submit
C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE

Filesize
201KB

MD5
74a044a62415d995102a0d58424bc49e

SHA1
10aeaa3fa60f5550bab9321048675c433a27e12a

SHA256
bf70a32a354a2c7ec912701f3350b8706bd9f422ea091de93088abe8e2b58efa

SHA512
0aa5780b75b506dadcdd3902b4defb847c1f7e6deca78596c70e95cf2e179489f8748e0580aacd07875aa75fba08af13e7c6463925424ead18720a2934ac210b

Download Submit
C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE

Filesize
250KB

MD5
cd4af683704c71887125716ca891e18c

SHA1
64d02bac29cfeeed31978438d572230f316d61df

SHA256
1e6a087180f0e5a8e738718de2d4d99c1a4b6d89bd2a84ad19ab45f7dd9225c5

SHA512
dda5661f1e95e1a6dc0ce62a5b476aa335ddde431d47fb6cabffe36947376f6c583f83560dc43da4bc4432052a95ed61f0553ade59308582510c25a5f828921a

Download Submit
C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE

Filesize
139KB

MD5
2925993d37c49204c9637e5c1bb5c949

SHA1
17dacda06c542a6fa6391b2b57aba8675cf7c924

SHA256
3c6212746a75da30bf30c420ce17f4a9d45e1cbd15df50b9acfcb4b655514a3e

SHA512
65616ffb2526adebcd447e9c7e838bb2a1dc5829c6097412fcdb2d245c33ea895922736d00bb45de4769307783c0670750ba3efcccd85c98f56a954334264965

Download Submit
C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE

Filesize
244KB

MD5
788fde156cc6e54ee2962198ac4a6c53

SHA1
09e1560bf5ec8fb5706a91eff97e327af7b962ae

SHA256
4c4344610c8ba2c3b2c0f2e47c45b1d8c9799ef3448d409607d1f139ee523ebc

SHA512
8ed288766dd4cc65328136d200bb1ed3a38c33b82720979be78ab02466b8dbaf800cceb0c5967268286b1adf3ec6446ceec42b1f12ab6f0ccb77fef29b0c2e8c

Download Submit
C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE

Filesize
276KB

MD5
ba7183fd7df27ec1e611f848d25ffdee

SHA1
0cc8f3e9c24da5f02ff57a66b9e7485763604beb

SHA256
7de95943142a2ccc03a6e84846b045c374bdb71a444b6116901d43f9f9e635ac

SHA512
2c6316e94a6d3dc668892aa7919ed2b8b852b5844c9e223329e3c91a4d0e6c3f5eb03dc327e3a92265e0fed89406cb2210b9b919331e3a8eda1ef4a55f74d3a5

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE

Filesize
509KB

MD5
fdad5d6d8cf37e8c446dcd6c56c718c3

SHA1
412883fd3bb56f2b850d2c29ee666d9b75636faf

SHA256
2ed31146dc94132acafc7e759086f18c83560693a813b1d842a30908f50faf7c

SHA512
9866ddd370e7ab75aea143c5ede3ee96700ed662aab7fb3e989f9beedb2800b488f985a8069a61025cc8201bbc42e23d744717988587c2a8a66f2e91ea7cbbbc

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE

Filesize
138KB

MD5
b84ae39dd0420080bd9e6b9557eea65b

SHA1
5326a058a3bcc4eb0530028e17d391e356210603

SHA256
92439a773781fc1b4e45de7fad393bb9ccd05af99dc1a1bb2246a4befb1f5924

SHA512
860ae09c5806622420147af1073cecc065786968737547276641af710b4caccd16b787bdf7212dd1d8ab16e257dd5c5cd20790bf000d75d82410cbd5bf7af388

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE

Filesize
1.6MB

MD5
ae390fa093b459a84c27b6c266888a7e

SHA1
ad88709a7f286fc7d65559e9aee3812be6baf4b2

SHA256
738b7b5da8ca4798043672d2a32913e0f64268c7861eecc9fcc4c7f9d440d8cd

SHA512
096b5190efefe4c5272637e0721dcd339883f551c5e0cce568ed0bd63b31fb9acef6b09d310966482dbc7a944cc7a5878b0ad6bd68c30d1871254865a1660851

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE

Filesize
1.1MB

MD5
24eeb998cb16869438b95642d49ac3dd

SHA1
b45aa87f45250aa3482c29b24fa4aa3d57ae4c71

SHA256
a2cfd55902b1750070e9154a90e29a10b9e6fa0c03bc82d8f198678e9bc46cd0

SHA512
2ac6de5c3e52b31355300ff4e846ed0627d8d4af02c4c07c0886694a09237ef2ee76e004883fae76a959bef0b60bd4138a9c88ad22139c6b859786c8e37bb358

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe

Filesize
3.6MB

MD5
69e1e0de795a8bf8c4884cb98203b1f4

SHA1
a17f2ba68776596e2d1593781289c7007a805675

SHA256
2b6d153b9df86033b7a83eb4f521fd4f7aeec35dc54ef8d1ffe80f5bbd030dbb

SHA512
353b664271d0f49f94b60c7fbaf5ab6d5b8df7690383517a90ba675f750d9b28628bbd5ed92a6782879607f4c21214b15ea95fd6a5a8d6f9540a1b75ddb9e665

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE

Filesize
1.6MB

MD5
af9aba6ab24cba804abba88d1626b2b9

SHA1
6a387c9ec2c06178476f8439a5a3d9149c480a9a

SHA256
e6a06e738140a8cc089bc607e5f5e1e2b224b71d52e0be0d01f9deb8e9763a90

SHA512
9e004f2eccb4e48d2c98a8168f7fe752ad3195b66f0aa1d7ec07dd5819539bc94a50ffb1deb291e7fea11932eb88fb5938b1ef0a93cd8b1902495d1f7bd2d950

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE

Filesize
2.8MB

MD5
032ee4d65b62d87cf809438556d30429

SHA1
34458fcefe3c67f19c3d2c94389fc99e54e74801

SHA256
0099c710e406e0423bb0b11eb4c113508c67f84a0972a2d14c038687cac1753b

SHA512
6b912d51e93f1e4756ecc5321ec08a6eb5e15413a9d9cf568bd14ce2a5199d064f6dd5c7d9d5155296d1a4ab5852c81a8fc138565fb788e7402c09b61281a5cd

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE

Filesize
1.3MB

MD5
b8bffe8467716db4da9d94061dc33d07

SHA1
db4bac1757b1b60b26e2fef0fc88ce708efad352

SHA256
b03986224aa28f1e1850bd2fcd1a5f5f2fea34c2c0815d8e6943f0a98b754af2

SHA512
5d6f6363c9c87c61d2be785280d420725fe7cc4b68908e78fc82dc480260a400500a84f1c9247b34437cd520d702ef5fc4546024fed891231630514d1418592c

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE

Filesize
1.1MB

MD5
a31628879099ba1efd1b63e81771f6c7

SHA1
42d9de49d0465c907be8ee1ef1ccf3926b8825fe

SHA256
031b0b0de72eba9350a1234eba7489bc04f94823501fc6a200266fa94b8c51dc

SHA512
0e86020f61fd08578507c3cd37385ffa2ffd964407a689b4c3d532fe4dc826eea58391f938840d18ecfa6bae79c6ece31b8f63b50366c2fa4d6ecf5194475759

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE

Filesize
1.1MB

MD5
ecda5b4161dbf34af2cd3bd4b4ca92a6

SHA1
a76347d21e3bfc8d9a528097318e4b037d7b1351

SHA256
98e7a35dd61a5eeea32ca5ff0f195b7e5931429e2e4b12d1e75ca09ddab3278f

SHA512
3cd3d64e7670ab824d36a792faa5d16a61f080d52345e07b0ef8396b2a1481876a3b30fc702bf0018a1b02c7788c3c7f1b016590c5b31485a90e3a375f11dade

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe

Filesize
3.2MB

MD5
6b7a2ce420e8dd7484ca4fa4460894ae

SHA1
df07e4a085fc29168ae9ec4781b88002077f7594

SHA256
dec51011b3bd2d82c42d13f043fac935b52adeaa17427ce4e21e34fcbd2231e4

SHA512
7d2cd278ee45ec0e14145f2be26b8cdbe3312b300aa216532c41e839ba61c12ae379025568c85634f0ec3bc95cc481bb17f99ab30c711986651569f0f1f81beb

Download Submit
C:\ProgramData\Synaptics\RCXE416.tmp

Filesize
1.1MB

MD5
8637c10cd4c0d9fd2e12bae1fa414744

SHA1
ca4cf0db8b5583a62c716b58a09fc03bdd048b46

SHA256
ee9aa3d4c0924658245ff692c959e727095e7b6d240723e95d487fd35e7dc465

SHA512
8ff8ff32154783e91d4311c44aeb31cc3b991edd311f41575d606bc41aaaacfbcbe3c79f41e15b1ef4c43a06989cbc52500406984a9c45217527202c03109129

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe

Filesize
7.3MB

MD5
ce8895c15a5a1032b28545b0a217bf4d

SHA1
9b09c3a1b7b33b2f945349989c4191d9adb4589f

SHA256
fe869c23e6ef9e2b37607cc29def9cae6d64fdad55c6473bea586ee584932000

SHA512
161b7f6211b8cb5f733d213fd32c6744cd7281a5927abc8734b4ddae6fa22b93034695a5194d4b138d7744b24fa5bcf6f04e683e7f4a91a030abcce61663b954

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

Filesize
6.8MB

MD5
bbe1b46695dbc8b5bb99969c8d915d8a

SHA1
30b38d6d1ab7c9fda36d23f6d0bcb668dde1b254

SHA256
f856d73b9078a6a18d9c50f55b16dfcef5bb278424a4c8f72a7b67913eeefcf7

SHA512
993edc8dbb70d1a8a71dadbc82ad94b22b708219130c53538cddaebbc10d1c3f85f598ee399213ba60dec692c652e9f5af569c8d8402ef80d924a839d533c1bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE

Filesize
5.7MB

MD5
acfeda55223b058a95094e4047d3b5f9

SHA1
4758a8a86ae2ee6bd0d56a9254b36271566aadf1

SHA256
a22463029d4c18618922556ce2ad23f9a61795290613c98d49de9a0db768ba0b

SHA512
3f33580f48cc5730199cf212e2927b148f00d297ce5f214998033160659bd33150928aceadf5a62eef32e2cb4cf34d8eab0c87ecc2b33fe42c8bc65f863c9654

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411242101581\additional_file0.tmp

Filesize
1.4MB

MD5
e9a2209b61f4be34f25069a6e54affea

SHA1
6368b0a81608c701b06b97aeff194ce88fd0e3c0

SHA256
e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

SHA512
59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

Filesize
6.8MB

MD5
e40995354682a246840f3fd61e329608

SHA1
daa2a1c48fda9688e5c4f8b9ca9289cbfc587afa

SHA256
489282f083bb6bf1fa87e0b92b810bd68509ee560517161eae4566740fcfcfaf

SHA512
f8327e2d8ef841fed3320092cd79a896b7e593d36875e285dfcf501e37a8ad8522b19b4384bc35eef39f208cbb8cf8e6731b8a381294f9738b5e6bf601585d9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\._cache__C578E~1.EXE

Filesize
3.4MB

MD5
8bc6d2ea5cb094e4e397501795f4bb13

SHA1
0e79b7f32e14715ca60f28c66e6073e1c62aa5e5

SHA256
33d1fe180655b2eaaa0c58d7f07c502c3bbbe243e3f99c9b8c62d1302c847716

SHA512
4711d6891587a6ee5b459f18f67bac0b8697c73bc6ee8359bc73a68539eedfff78ae596347e493d80cb77cb8ad2b86695f9ac990657336cb620afd3e3fab8997

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\._cache__CACHE~1.EXE

Filesize
5.7MB

MD5
96a70eb42fa76634bd69c9f0f82b25c7

SHA1
c6e6b091e64bb8c98d378730af947460baefc97e

SHA256
e79d0c82d37bf9f1b1753d9ce2357550aea1e324fa6333ff11e739f2b9ce5d7d

SHA512
bb64848def728f6e9da0addd5e7b824523fcbbefff77303e648f85e610e70bca4352efb691087f706d562edaa1e877a45c3623eb87950ecdba64704b2a63eede

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\._cache__CACHE~2.EXE

Filesize
4.5MB

MD5
79c559f6641ce4d482beaa9d9f4751bd

SHA1
cd5e7c32eb235ca8123048036cd564459a3a8c0e

SHA256
43e0e627cf0e99635119a27b2eede952636970775eab3d62d9b29cbb1cf83af6

SHA512
bf909d29652bc52f81a310cca45a2778d067af8a815f860b158a6404bad4e945cc3265516f9265e0be39c48d54442e8df724ede0ebaa0d99509159e5d7b3c003

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\47ab2ff6563ef11e23c616d6562686dec33d49f8ad7850469be9d454dfb4c456N.exe

Filesize
7.9MB

MD5
31157ebbf68507996bc2e48aa53f3184

SHA1
45ce9ca220a59d9ff7b0b7b6a2bcfe30e2881616

SHA256
55ea7ef8eccce1011d6f7e62527525028294a29bbdd561d96aa6adf80ddf1a12

SHA512
39001566173c67f3958a428eb9aa33024096176af9059643339263d01613e6ba2d463ec5cad6ddfc6a6bcbc710828f550fde1a48d9f9d744935a7c1366bf66e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe

Filesize
3.2MB

MD5
ad8536c7440638d40156e883ac25086e

SHA1
fa9e8b7fb10473a01b8925c4c5b0888924a1147c

SHA256
73d84d249f16b943d1d3f9dd9e516fadd323e70939c29b4a640693eb8818ee9a

SHA512
b5f368be8853aa142dba614dcca7e021aba92b337fe36cfc186714092a4dab1c7a2181954cd737923edd351149980182a090dbde91081c81d83f471ff18888fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2411242101226142096.dll

Filesize
5.2MB

MD5
979c350a591b0be4cc8def3fb1ac84b4

SHA1
398a17f8c20e5562e4a639df77fe26342a29e87f

SHA256
8cda9e98bc8de227311316d3128d55813b85ebb47d31b9eb628a0831ce8c7a08

SHA512
eee2470bcbec5716eb15068dce5b027e09898468c30e5c78ce0e92ea3ad9b04ef5421e1ee8d33d9d52221e286d802ac9495b22b577e85cdfdb20c8e414aed0ba

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

Filesize
40B

MD5
6b91e10503cb65a53ecf86053a409af1

SHA1
f75528dbdf07a5960172ca99787f81871060353d

SHA256
c51f96864cffcb0a5be3d4e6e4ad55f8ac53c2dbc6899e92d4ef5510d7822dd1

SHA512
0415db6c1f565709161f4ae39f2ba4b9662b4680e8de587c3810eb484be2b1037f98992d5ea43b69d11f1b390bd9fea9b7c7dc3aaacc620605c3be002104d0ff

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

Filesize
40B

MD5
47ad08c514f1c7010b694a1ab3662a8e

SHA1
ab6a6da59063a59b3bcb9b5632fce37aefbe83d1

SHA256
1d4fc315e6a3934000f261ae3bc8802f3ae94791a9ba161986a7c490c2076263

SHA512
93fc4f458bf186ae0977142bf25705414acaa75b4af80bba8be1bd166a1d500f4bd1f6925ebcd4e0e9f94c870f958fb1b634cee62c99b4c18681ce6811d15601

Download Submit
C:\Windows\directx.sys

Filesize
57B

MD5
b42f2603883dadf133cee3ae5d767bb2

SHA1
dc4161551044405353e870b029afff27c8030e22

SHA256
998e1546bc98d29ffccb70e81ed00a01f3dbd3015e947d1aabca4cb01775ce28

SHA512
a4c33c9b87f84b4aba84ecf8b0b2d8a90703ef8523f1d057824196e584451072ab5bbc96e0c95a319baaffd16ba7a26f940fec2e28e9228e1275c87fb061c02d

Download Submit
C:\Windows\directx.sys

Filesize
57B

MD5
8e4bd9619c227ef2bc20a2cb2aa55e7b

SHA1
a6214b7678b83c4db74b210625b4812300df3a74

SHA256
84ba3f2b07e112efaff6ee034b84db960521db9e504a4ac77a5e8e5e988d86d9

SHA512
12a6a559b89441983e9aab70f0ea17dc790bc48c7938dd573c888e33811db8fb210539ebebaa6c8f5c04971d72d037be6603de15ea3a1ffc0f5ea3dd5132b4bf

Download Submit
C:\Windows\directx.sys

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\directx.sys

Filesize
57B

MD5
56abc40d1e45c091d8afddb90a4ce6b4

SHA1
08db549484467b32b79958700300cabefc659848

SHA256
a43fa861957415e3b0f25e2b54d931961cd309ff1d5354a9362852895b90b3e1

SHA512
51625c015a7c8fcf6fb51d3396aa08d2068772e3fcacaf32c409e82071af4ba1eb2ee94f36c06a98c32ba59d23bbaa6b540f7bd418a9472303cc225151daa698

Download Submit
C:\Windows\directx.sys

Filesize
55B

MD5
cc2f3b51f2e78cafce999e604a8b3277

SHA1
f2e64b7d1f0581052cbfea99a8a809922a62e69c

SHA256
e6475c558d13bbad756c32a904648acf36c3f9bddd7aad597847cc159696c06f

SHA512
2cba040b4f1a5e137e9e44b1364ccec43173b677a24a3318b599c86ea4482ae2aaeb9f2af3be72fe6514dda0879b0bd506acd1e08b48f963c6ae446fc06cb6a1

Download Submit
C:\Windows\svchost.com

Filesize
40KB

MD5
c958892f56d8622631a8816ad56c5aff

SHA1
711a393a350dc3714c392b3508b7e4f00d0d6579

SHA256
c9b749b84cb69a49505a20005d0763ea651cf839b51f24f46650cfb16ceaa420

SHA512
bf083d1ad37047b68cbd370afe27987cb61f2876527a174b82e2837aeac70012af4b9f6cc49f5b6515fd582c45d87c9e54793d18fa114e396320b6e8582407f1

Download Submit
memory/316-334-0x0000000000400000-0x0000000000AD1000-memory.dmp

Filesize
6.8MB

Download
memory/400-757-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/400-1523-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/400-833-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/404-1257-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/948-855-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/948-759-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/956-542-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1112-193-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1208-725-0x0000000000400000-0x00000000009B1000-memory.dmp

Filesize
5.7MB

Download
memory/1316-675-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1520-995-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/1520-860-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/1708-612-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1792-1268-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/1820-1532-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/1848-830-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2012-1690-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/2012-2128-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/2092-756-0x0000000000400000-0x0000000000890000-memory.dmp

Filesize
4.6MB

Download
memory/2092-449-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2096-770-0x0000000000480000-0x0000000000A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2096-777-0x0000000000480000-0x0000000000A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2248-376-0x00007FF9C4430000-0x00007FF9C4440000-memory.dmp

Filesize
64KB

Download
memory/2248-343-0x00007FF9C6710000-0x00007FF9C6720000-memory.dmp

Filesize
64KB

Download
memory/2248-346-0x00007FF9C6710000-0x00007FF9C6720000-memory.dmp

Filesize
64KB

Download
memory/2248-369-0x00007FF9C4430000-0x00007FF9C4440000-memory.dmp

Filesize
64KB

Download
memory/2248-344-0x00007FF9C6710000-0x00007FF9C6720000-memory.dmp

Filesize
64KB

Download
memory/2248-345-0x00007FF9C6710000-0x00007FF9C6720000-memory.dmp

Filesize
64KB

Download
memory/2248-348-0x00007FF9C6710000-0x00007FF9C6720000-memory.dmp

Filesize
64KB

Download
memory/2312-1308-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/2400-593-0x0000000000400000-0x0000000000AD1000-memory.dmp

Filesize
6.8MB

Download
memory/2448-1278-0x00000000007C0000-0x0000000000D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2448-1284-0x00000000007C0000-0x0000000000D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2460-372-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2460-591-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2460-802-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2480-789-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/2480-875-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/2492-546-0x0000000000400000-0x0000000000AD1000-memory.dmp

Filesize
6.8MB

Download
memory/2612-712-0x0000000000400000-0x00000000009B1000-memory.dmp

Filesize
5.7MB

Download
memory/2660-590-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2828-751-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2832-592-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2908-942-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/2988-758-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2988-1334-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/2988-1252-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/3016-583-0x0000000000400000-0x0000000000890000-memory.dmp

Filesize
4.6MB

Download
memory/3056-826-0x0000000000500000-0x0000000000ABB000-memory.dmp

Filesize
5.7MB

Download
memory/3056-832-0x0000000000500000-0x0000000000ABB000-memory.dmp

Filesize
5.7MB

Download
memory/3124-624-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3148-727-0x0000000000400000-0x00000000009B1000-memory.dmp

Filesize
5.7MB

Download
memory/3296-753-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3420-434-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3432-618-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3436-349-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3488-750-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3512-142-0x0000000000400000-0x0000000000BF2000-memory.dmp

Filesize
7.9MB

Download
memory/3512-13-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/3528-377-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3644-790-0x0000000000400000-0x0000000000890000-memory.dmp

Filesize
4.6MB

Download
memory/3788-684-0x0000000000400000-0x00000000009B1000-memory.dmp

Filesize
5.7MB

Download
memory/3840-793-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3864-368-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3928-731-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3992-427-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3992-837-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3992-717-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4012-785-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4080-719-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4212-543-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4384-581-0x0000000000400000-0x0000000000AD1000-memory.dmp

Filesize
6.8MB

Download
memory/4424-375-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4496-448-0x0000000000400000-0x0000000000BF2000-memory.dmp

Filesize
7.9MB

Download
memory/4528-444-0x0000000000400000-0x00000000009B1000-memory.dmp

Filesize
5.7MB

Download
memory/4652-1163-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/4652-868-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/4676-1567-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/4676-1521-0x0000000000DB0000-0x000000000136B000-memory.dmp

Filesize
5.7MB

Download
memory/4744-547-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4796-548-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4888-720-0x0000000000400000-0x00000000009B1000-memory.dmp

Filesize
5.7MB

Download
memory/4920-1274-0x00000000002F0000-0x00000000008AB000-memory.dmp

Filesize
5.7MB

Download
memory/4920-1272-0x00000000002F0000-0x00000000008AB000-memory.dmp

Filesize
5.7MB

Download
memory/4984-447-0x0000000000400000-0x0000000000BF2000-memory.dmp

Filesize
7.9MB

Download