Overview

overview

8

Static

static

8

TLauncher-....1.exe

windows10-2004-x64

7

TLauncher-....1.exe

windows11-21h2-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    390s
  • max time network
    316s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    15/04/2026, 18:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TLauncher-Installer-1.9.5.1.exe
  • Size 25.5MB
  • Sample260415-w1999aax2x
  • SHA256 0619bd07d3183a8ae0cb1be408c6ad32295d47ddd666b2d51edd4d5f5d211227
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 16 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 19 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.5.1.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.5.1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3712
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3969818 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.5.1.exe" "__IRCT:3" "__IRTSS:26673860" "__IRSID:S-1-5-21-600123060-2148212387-2211176695-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2956
      • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6000
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:3839250 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:3869932" "__IRSID:S-1-5-21-600123060-2148212387-2211176695-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3788
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4640
            • C:\Users\Admin\AppData\Local\Temp\7zS0222C278\installer.exe
              C:\Users\Admin\AppData\Local\Temp\7zS0222C278\installer.exe --silent --allusers=0 --server-tracking-blob=YjZjZjZiYmIwM2UxZGI4Y2ZmNTNmZTkzNGI4Y2Y0MWQ0Mjg0MjQwMTE4NGY1MTdkZTJiZGMxYjhlYjZlYTA0ZTp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInRpbWVzdGFtcCI6IjE3NzYyNzc1MzkuMTYxMyIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOC4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFHWCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiOTI1NWJhZjktZjVkYi00MzgxLWI2YzItNjhiZDI1NWMyYWZhIn0=
              6⤵
              • Executes dropped EXE
              • Enumerates connected drives
              • Enumerates system info in registry
              • Modifies system certificate store
              • Suspicious use of WriteProcessMemory
              PID:4376
              • C:\Users\Admin\AppData\Local\Temp\7zS0222C278\installer.exe
                C:\Users\Admin\AppData\Local\Temp\7zS0222C278\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=129.0.5823.70 --initial-client-data=0x290,0x294,0x298,0x270,0x29c,0x7ff777508868,0x7ff777508874,0x7ff777508880
                7⤵
                • Executes dropped EXE
                PID:2328
              • C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\installer.exe" --version
                7⤵
                • Executes dropped EXE
                PID:2988
              • C:\Users\Admin\AppData\Local\Temp\7zS0222C278\installer.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS0222C278\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=4376 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_20260415192538" --session-guid=3a7bb302-c874-4d96-957f-8c0f8acf6ec2 --server-tracking-blob="ZTU2NjBmNzkxOTA4MGRkMWFlZTFlOGE1MjQwMDFiZWI3NzAwNjkzOWVhNzk4MDBhZDJjNjRiMTA2MmY5YTg5Yzp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc3NjI3NzUzOS4xNjEzIiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSA4LjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYUdYIiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJNU1RMIn0sInV1aWQiOiI5MjU1YmFmOS1mNWRiLTQzODEtYjZjMi02OGJkMjU1YzJhZmEifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7408000000000000
                7⤵
                • Executes dropped EXE
                • Enumerates connected drives
                • Enumerates system info in registry
                • Suspicious use of WriteProcessMemory
                PID:2316
                • C:\Users\Admin\AppData\Local\Temp\7zS0222C278\installer.exe
                  C:\Users\Admin\AppData\Local\Temp\7zS0222C278\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=129.0.5823.70 --initial-client-data=0x278,0x26c,0x2a4,0x27c,0x2a8,0x7ff777508868,0x7ff777508874,0x7ff777508880
                  8⤵
                  • Executes dropped EXE
                  PID:3372
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\installer.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\installer.exe" --backend --initial-pid=4376 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381" --session-guid=3a7bb302-c874-4d96-957f-8c0f8acf6ec2 --server-tracking-blob="ZTU2NjBmNzkxOTA4MGRkMWFlZTFlOGE1MjQwMDFiZWI3NzAwNjkzOWVhNzk4MDBhZDJjNjRiMTA2MmY5YTg5Yzp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc3NjI3NzUzOS4xNjEzIiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSA4LjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYUdYIiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJNU1RMIn0sInV1aWQiOiI5MjU1YmFmOS1mNWRiLTQzODEtYjZjMi02OGJkMjU1YzJhZmEifQ== " --silent --desktopshortcut=1 --install-subfolder=129.0.5823.70
                  8⤵
                  • Executes dropped EXE
                  • Enumerates connected drives
                  • Enumerates system info in registry
                  • Modifies registry class
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:5996
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\installer.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=129.0.5823.70 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff76fab8868,0x7ff76fab8874,0x7ff76fab8880
                    9⤵
                    • Executes dropped EXE
                    PID:5484
                  • C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381\assistant\assistant_installer.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --copyonly=0 --allusers=0
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Enumerates system info in registry
                    • Modifies Internet Explorer settings
                    • Suspicious use of WriteProcessMemory
                    PID:4720
                    • C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381\assistant\assistant_installer.exe
                      "C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=129.0.5823.49 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x37ddc0,0x37ddcc,0x37ddd8
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:5056
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --run-assistant --allusers=0
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:5072
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=129.0.5823.49 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x4cddc0,0x4cddcc,0x4cddd8
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        PID:3688
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe"
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:5632
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Enumerates system info in registry
                          • Suspicious use of WriteProcessMemory
                          PID:3536
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\opera_crashreporter.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=129.0.5823.70 --initial-client-data=0x150,0x154,0x158,0x14c,0x15c,0x7ff8a98f7bd0,0x7ff8a98f7be0,0x7ff8a98f7bf0
                            13⤵
                            • Executes dropped EXE
                            PID:948
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Enumerates system info in registry
                          • Suspicious use of WriteProcessMemory
                          PID:3460
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\opera_crashreporter.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=129.0.5823.70 --initial-client-data=0x14c,0x150,0x154,0x148,0x158,0x7ff8a98f7bd0,0x7ff8a98f7be0,0x7ff8a98f7bf0
                            13⤵
                            • Executes dropped EXE
                            PID:1584
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=129.0.5823.49 --initial-client-data=0x290,0x294,0x298,0x268,0x29c,0x911c90,0x911c9c,0x911ca8
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:376
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Enumerates system info in registry
                            • Suspicious use of WriteProcessMemory
                            PID:3848
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\opera_crashreporter.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=129.0.5823.70 --initial-client-data=0x148,0x14c,0x150,0x144,0x154,0x7ff8a98f7bd0,0x7ff8a98f7be0,0x7ff8a98f7bf0
                              14⤵
                              • Executes dropped EXE
                              PID:3376
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Enumerates system info in registry
                            • Suspicious use of WriteProcessMemory
                            PID:4812
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\opera_crashreporter.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=129.0.5823.70 --initial-client-data=0x15c,0x160,0x164,0x158,0x168,0x7ff8a98f7bd0,0x7ff8a98f7be0,0x7ff8a98f7bf0
                              14⤵
                              • Executes dropped EXE
                              PID:6040
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Enumerates system info in registry
                            • Suspicious use of WriteProcessMemory
                            PID:2456
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\opera_crashreporter.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=129.0.5823.70 --initial-client-data=0x148,0x14c,0x150,0x144,0x154,0x7ff8a98f7bd0,0x7ff8a98f7be0,0x7ff8a98f7bf0
                              14⤵
                              • Executes dropped EXE
                              PID:1788
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • Drops file in Windows directory
                    • Enumerates system info in registry
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of WriteProcessMemory
                    PID:1300
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\opera_crashreporter.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=129.0.5823.70 --initial-client-data=0x148,0x14c,0x150,0x144,0x154,0x7ff8a98f7bd0,0x7ff8a98f7be0,0x7ff8a98f7bf0
                      10⤵
                      • Executes dropped EXE
                      PID:2300
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,8555418106037798754,13018607405920246355,262144 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1868 /prefetch:2
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:460
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1968,i,9703224849560350508,13238561802272922528,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1984 /prefetch:11
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Time Discovery
                      • Enumerates system info in registry
                      PID:3200
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2380,i,11113269849306298703,16057159899974102057,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2488 /prefetch:13
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:1800
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2996,i,10881392842521326561,1783168916050102445,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3256 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:3964
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2916,i,14610780979578426299,2754789654847651480,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3188 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:3000
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3004,i,17620190570303344545,12145220202093856157,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=2948 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5808
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3144,i,8763175219774097804,635436375278186762,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3096 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:2484
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3156,i,4433014227857827419,6753081230579805506,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3316 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:884
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3168,i,1763766335021411508,4881616805457405417,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3336 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:1328
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 OPR/129.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4056,i,3937265279292370785,822245312110983238,2097152 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4076 /prefetch:1
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:4692
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\opera_gx_splash.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\opera_gx_splash.exe" --instance-name=61C8973803226C4D4008DEBC18682105EDAB1556896BB924D0EEB1B6C96AB147
                      10⤵
                      • Executes dropped EXE
                      PID:2172
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 OPR/129.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4616,i,5955661348004603107,2534708226706405251,2097152 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4632 /prefetch:1
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:4468
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 OPR/129.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4740,i,2966686687150840859,5584918974350478675,2097152 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4784 /prefetch:9
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:2180
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 OPR/129.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5024,i,13899828496565446246,11974428868272673454,2097152 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5044 /prefetch:1
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:4056
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 OPR/129.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5072,i,15521670818556071061,16266887968193196280,2097152 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5168 /prefetch:1
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:664
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --asus-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5200,i,11864343090382662405,6418620832308098417,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5216 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:3840
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --corsair-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5204,i,17696741923304792674,14567805216846866296,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5164 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:1440
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --logitech-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5208,i,13662772796406652878,18173679819067448326,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5360 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:3884
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --razer-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5212,i,17425311266698349048,18360575213561808522,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5380 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:1304
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 OPR/129.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6064,i,1879717863579688921,5399109314995324767,2097152 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6076 /prefetch:9
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:5712
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 OPR/129.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6300,i,15802326119410115809,9901272152985997275,2097152 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6384 /prefetch:9
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:5940
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6708,i,9762047538449359589,3428444722528471102,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6652 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:4140
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6852,i,15858445088197528229,13788552873927456135,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=6880 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      PID:3508
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7128,i,2733744996699899715,4853822129336120014,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7140 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:5396
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7240,i,3196994887364007851,14116125921508959351,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7272 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:1260
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7288,i,1048100021017983175,15890734066432185564,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7412 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:1776
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7440,i,17202737082939225358,10381075788644686376,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7460 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:4536
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 OPR/129.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6316,i,9641361871563210894,4376639207025059118,2097152 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=7804 /prefetch:1
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:5872
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6416,i,9874912273881639365,18243130622222790118,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=7724 /prefetch:12
                      10⤵
                      • Executes dropped EXE
                      PID:1020
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8048,i,6404681137354054532,5240230068009498143,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8088 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:3548
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6256,i,12786912677066069874,14023030799269425553,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8056 /prefetch:14
                      10⤵
                      • Enumerates system info in registry
                      PID:3412
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8100,i,12878601764412640416,13500133947094291822,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8156 /prefetch:14
                      10⤵
                      • Enumerates system info in registry
                      PID:3404
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8084,i,8268022880299061677,3861227325429820866,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8136 /prefetch:14
                      10⤵
                      • Enumerates system info in registry
                      PID:5492
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8112,i,493595905699715540,13951021044672668806,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8176 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:5732
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8528,i,6562410462288291402,4221388398394778146,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=8592 /prefetch:14
                      10⤵
                      • Enumerates system info in registry
                      PID:412
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 OPR/129.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=9024,i,1754561937597862477,7682187648793605051,2097152 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9068 /prefetch:9
                      10⤵
                        PID:6196
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 OPR/129.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=9244,i,16963538790945332770,15029887720593571697,2097152 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=9292 /prefetch:9
                        10⤵
                        • Enumerates system info in registry
                        PID:6464
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9804,i,13694428376189649674,14459399628102481325,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=9272 /prefetch:14
                        10⤵
                        • Enumerates system info in registry
                        PID:7316
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --au-use-mojo --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --pipeid=oauc_pipeF347B60CA73F3F3DA84B31019F4EB851ECFC332513021FC062CC0CA8D8440B54
                        10⤵
                        • Enumerates system info in registry
                        PID:8120
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=129.0.5823.70 --initial-client-data=0x284,0x288,0x28c,0x25c,0x290,0x7ff7f3f216f8,0x7ff7f3f21704,0x7ff7f3f21710
                          11⤵
                            PID:7636
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:address-bar-intent-internal-matching=on --with-feature:address-bar-intent-server-switch=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-filter=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-with-misspells=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-use-mojo-in-au=on --with-feature:keywords-from-backend=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9964,i,17305130879974325149,15378944591450252504,524288 --field-trial-handle=1872,i,13732160970363303125,11852393017455234135,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=9992 /prefetch:14
                          10⤵
                          • Enumerates system info in registry
                          PID:8132
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --edition=std-2 --host=https://autoupdate.opera.com/ --installationdatadir="C:\Users\Admin\AppData\Local\Programs\Opera GX" --installdir="C:\Users\Admin\AppData\Local\Programs\Opera GX" --lang=en-US --pipeid --producttype --requesttype=shutdown --version=129.0.5823.70 --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --firstrunver=129.0.5823.70 --firstrunts=1776277566 --consent-info=eyJzdGF0aXN0aWNzX2NvbGxlY3Rpb25fZW5hYmxlZCI6dHJ1ZSwidXNlcl9leHBlcmllbmNlX21ldHJpY3NfcmVwb3J0aW5nX2VuYWJsZWQiOnRydWV9
                          10⤵
                            PID:7220
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=129.0.5823.70 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff7f3f216f8,0x7ff7f3f21704,0x7ff7f3f21710
                              11⤵
                                PID:7676
                      • C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381\assistant\Opera_GX_assistant_129.0.5823.49_Setup.exe_sfx.exe
                        "C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381\assistant\Opera_GX_assistant_129.0.5823.49_Setup.exe_sfx.exe"
                        7⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:5556
                      • C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381\assistant\assistant_installer.exe
                        "C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381\assistant\assistant_installer.exe" --version
                        7⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Enumerates system info in registry
                        • Suspicious use of WriteProcessMemory
                        PID:4048
                        • C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381\assistant\assistant_installer.exe
                          "C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=129.0.5823.49 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x37ddc0,0x37ddcc,0x37ddd8
                          8⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:1180
              • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4876
                • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
                  4⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:5988
                  • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=windows-1252 -jar C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                    5⤵
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:2220
                    • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.91-windows-x64\bin\java.exe
                      C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.91-windows-x64\bin\java.exe -Dsun.java2d.uiScale.enabled=false -Xmx1536m -Dfile.encoding=UTF8 -Djava.net.preferIPv4Stack=true --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.desktop/java.awt=ALL-UNNAMED --add-opens=java.desktop/sun.awt.image=ALL-UNNAMED --add-opens=java.desktop/sun.java2d=ALL-UNNAMED --add-opens=java.desktop/java.awt.color=ALL-UNNAMED --add-opens=java.desktop/java.awt.image=ALL-UNNAMED --add-opens=java.desktop/com.apple.eawt=ALL-UNNAMED --add-opens=java.base/java.util.regex=ALL-UNNAMED --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.desktop/java.beans=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.network=ALL-UNNAMED --add-opens=javafx.web/javafx.scene.web=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.event=ALL-UNNAMED -cp C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\annotations-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aopalliance-1.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\arns-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\auth-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-query-protocol-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-xml-protocol-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checker-qual-3.12.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checksums-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checksums-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-codec-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-compress-1.23.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-io-2.11.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-lang3-3.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-1.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-api-1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-vfs2-2.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\crt-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\desktop-common-util-1.267.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\DiscordIPC-0.5.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\dnsjava-2.1.8.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\endpoints-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\error_prone_annotations-2.18.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\eventstream-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\failureaccess-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\filters-2.0.235.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\fluent-hc-4.5.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\gson-2.13.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guava-31.0.1-jre.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-assistedinject-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-aws-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-aws-eventstream-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-client-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-download-1.267.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpclient-4.5.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpcore-4.4.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\identity-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\j2objc-annotations-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jackson-annotations-2.13.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jakarta.inject-api-2.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\java-image-scaling-0.8.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-21.0.9-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-21.0.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-21.0.9-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-21.0.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-21.0.9-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-21.0.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-21.0.9-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-21.0.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-21.0.9-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-21.0.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-21.0.9-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-21.0.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javax.annotation-api-1.3.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-api-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-core-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-impl-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jcl-over-slf4j-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-20230227.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-utils-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jsr305-3.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-native-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junrar-0.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\log4j-1.2.17.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-classic-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-core-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\lombok-1.18.30.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-api-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svn-commons-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svnexe-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\metrics-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\MinecraftServerPing-1.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\mockserver-netty-no-dependencies-5.14.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\modpack-dto-2.282.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\picture-bundle-3.72.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\plexus-utils-1.5.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\profiles-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\protocol-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\reactive-streams-1.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regexp-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regions-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\retries-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\retries-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\s3-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\sdk-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\skin-api-1.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\slf4j-api-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\statistics-dto-1.73.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\third-party-jackson-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\tlauncher-resource-1.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\utils-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\utils-lite-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\xz-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\original-TLauncher-2.9361.jar; org.tlauncher.tlauncher.rmo.TLauncher -starterConfig=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\starter.json -requireUpdate=false -currentAppVersion=2.9361 -starterDomainAvailabilityV1=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\domainAvailability.json -country=${country} "-starterJVM=C:\Program Files\Java\jre-1.8\bin\javaw.exe" -starterWorkingDirectory=C:\Users\Admin\AppData\Local\Temp -starterJarFile=C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe -starterFileEncoding=windows-1252
                      6⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • System Time Discovery
                      • Checks processor information in registry
                      • Suspicious use of SetWindowsHookEx
                      PID:6844
                      • C:\Windows\SYSTEM32\cmd.exe
                        cmd.exe /C chcp 437 & wmic CPU get NAME
                        7⤵
                          PID:2084
                          • C:\Windows\system32\chcp.com
                            chcp 437
                            8⤵
                              PID:4124
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic CPU get NAME
                              8⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:7720
                          • C:\Windows\SYSTEM32\cmd.exe
                            cmd.exe /C chcp 437 & set processor
                            7⤵
                              PID:8032
                              • C:\Windows\system32\chcp.com
                                chcp 437
                                8⤵
                                  PID:2312
                              • C:\Windows\SYSTEM32\cmd.exe
                                cmd.exe /C chcp 437 & dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt
                                7⤵
                                  PID:7828
                                  • C:\Windows\system32\chcp.com
                                    chcp 437
                                    8⤵
                                      PID:4196
                                    • C:\Windows\system32\dxdiag.exe
                                      dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt
                                      8⤵
                                      • Drops file in System32 directory
                                      • Checks SCSI registry key(s)
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4724
                                  • C:\Windows\SYSTEM32\cmd.exe
                                    cmd.exe /C chcp 437 & wmic qfe get HotFixID
                                    7⤵
                                      PID:5596
                                      • C:\Windows\system32\chcp.com
                                        chcp 437
                                        8⤵
                                          PID:2404
                                        • C:\Windows\System32\Wbem\WMIC.exe
                                          wmic qfe get HotFixID
                                          8⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2896
                                      • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\bin\javaw.exe
                                        C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\bin\javaw.exe "-Dos.name=Windows 10" -Dos.version=10.0 -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Xss1M --sun-misc-unsafe-memory-access=allow --enable-native-access=ALL-UNNAMED -Djava.library.path=C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.1.2\natives -Djna.tmpdir=C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.1.2\natives -Dorg.lwjgl.system.SharedLibraryExtractPath=C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.1.2\natives -Dio.netty.native.workdir=C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.1.2\natives -Dminecraft.launcher.brand=minecraft-launcher -Dminecraft.launcher.version=2.3.173 -cp C:\Users\Admin\AppData\Roaming\.minecraft\libraries\at\yawk\lz4\lz4-java\1.10.1\lz4-java-1.10.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\azure\azure-json\1.4.0\azure-json-1.4.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\github\oshi\oshi-core\6.9.0\oshi-core-6.9.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\code\gson\gson\2.13.2\gson-2.13.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\failureaccess\1.0.3\failureaccess-1.0.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\guava\33.5.0-jre\guava-33.5.0-jre.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\ibm\icu\icu4j\77.1\icu4j-77.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\microsoft\azure\msal4j\1.23.1\msal4j-1.23.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\tlauncher\authlib\7.0.63.1\authlib-7.0.63.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\blocklist\1.0.10\blocklist-1.0.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\brigadier\1.3.10\brigadier-1.3.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\datafixerupper\9.0.19\datafixerupper-9.0.19.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\jtracy\1.0.37\jtracy-1.0.37.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\jtracy\1.0.37\jtracy-1.0.37-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\logging\1.6.11\logging-1.6.11.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\tlauncher\patchy\2.2.101\patchy-2.2.101.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\text2speech\1.18.11\text2speech-1.18.11.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-codec\commons-codec\1.19.0\commons-codec-1.19.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-io\commons-io\2.20.0\commons-io-2.20.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-buffer\4.2.7.Final\netty-buffer-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-codec-base\4.2.7.Final\netty-codec-base-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-codec-compression\4.2.7.Final\netty-codec-compression-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-codec-http\4.2.7.Final\netty-codec-http-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-common\4.2.7.Final\netty-common-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-handler\4.2.7.Final\netty-handler-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-resolver\4.2.7.Final\netty-resolver-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-classes-epoll\4.2.7.Final\netty-transport-classes-epoll-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-classes-kqueue\4.2.7.Final\netty-transport-classes-kqueue-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-native-unix-common\4.2.7.Final\netty-transport-native-unix-common-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport\4.2.7.Final\netty-transport-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\it\unimi\dsi\fastutil\8.5.18\fastutil-8.5.18.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\java\dev\jna\jna-platform\5.17.0\jna-platform-5.17.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\java\dev\jna\jna\5.17.0\jna-5.17.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\sf\jopt-simple\jopt-simple\5.0.4\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\commons\commons-compress\1.28.0\commons-compress-1.28.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\commons\commons-lang3\3.19.0\commons-lang3-3.19.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-api\2.25.2\log4j-api-2.25.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-core\2.25.2\log4j-core-2.25.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-slf4j2-impl\2.25.2\log4j-slf4j2-impl-2.25.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\jcraft\jorbis\0.0.17\jorbis-0.0.17.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\joml\joml\1.10.8\joml-1.10.8.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\jspecify\jspecify\1.0.0\jspecify-1.0.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.4.1\lwjgl-freetype-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.4.1\lwjgl-freetype-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.4.1\lwjgl-freetype-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.4.1\lwjgl-freetype-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.4.1\lwjgl-glfw-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.4.1\lwjgl-glfw-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.4.1\lwjgl-glfw-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.4.1\lwjgl-glfw-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.4.1\lwjgl-jemalloc-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.4.1\lwjgl-jemalloc-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.4.1\lwjgl-jemalloc-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.4.1\lwjgl-jemalloc-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.4.1\lwjgl-openal-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.4.1\lwjgl-openal-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.4.1\lwjgl-openal-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.4.1\lwjgl-openal-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.4.1\lwjgl-opengl-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.4.1\lwjgl-opengl-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.4.1\lwjgl-opengl-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.4.1\lwjgl-opengl-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.4.1\lwjgl-stb-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.4.1\lwjgl-stb-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.4.1\lwjgl-stb-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.4.1\lwjgl-stb-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.4.1\lwjgl-tinyfd-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.4.1\lwjgl-tinyfd-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.4.1\lwjgl-tinyfd-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.4.1\lwjgl-tinyfd-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.4.1\lwjgl-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.4.1\lwjgl-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.4.1\lwjgl-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.4.1\lwjgl-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\slf4j\slf4j-api\2.0.17\slf4j-api-2.0.17.jar;C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.1.2\26.1.2.jar -Xmx10922M -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1NewSizePercent=20 -XX:G1ReservePercent=20 -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=32M -Dfml.ignoreInvalidMinecraftCertificates=true -Dfml.ignorePatchDiscrepancies=true -Djava.net.preferIPv4Stack=true -Dminecraft.applet.TargetDirectory=C:\Users\Admin\AppData\Roaming\.minecraft -DlibraryDirectory=C:\Users\Admin\AppData\Roaming\.minecraft\libraries -Dcountry=${country} -Dlog4j.configurationFile=C:\Users\Admin\AppData\Roaming\.minecraft\assets\log_configs\client-1.21.2.xml net.minecraft.client.main.Main --username no --version 26.1.2 --gameDir C:\Users\Admin\AppData\Roaming\.minecraft --assetsDir C:\Users\Admin\AppData\Roaming\.minecraft\assets --assetIndex 30 --uuid 23bc4247aeca49bfa530ee5fcf42a171 --accessToken null --clientId null --xuid null --versionType release --width 925 --height 530
                                        7⤵
                                        • Checks processor information in registry
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:8124
                          • C:\Windows\system32\wbem\unsecapp.exe
                            C:\Windows\system32\wbem\unsecapp.exe -Embedding
                            1⤵
                              PID:2448
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe"
                              1⤵
                                PID:4792
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\opera_crashreporter.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=129.0.5823.70 --initial-client-data=0x148,0x14c,0x150,0x144,0x154,0x7ff8a98f7bd0,0x7ff8a98f7be0,0x7ff8a98f7bf0
                                  2⤵
                                    PID:6552
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --au-use-mojo --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe7FAE56220944838BCDB933E86AD23A432FE91C0ADA84DF94778C72EE141B2B1F --au-use-mojo
                                  1⤵
                                  • Enumerates system info in registry
                                  PID:8148
                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=129.0.5823.70 --initial-client-data=0x280,0x284,0x288,0x218,0x28c,0x7ff7f3f216f8,0x7ff7f3f21704,0x7ff7f3f21710
                                    2⤵
                                      PID:6328
                                  • C:\Windows\System32\GameBarPresenceWriter.exe
                                    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                                    1⤵
                                    • Network Service Discovery
                                    PID:5316
                                  • C:\Windows\system32\OpenWith.exe
                                    C:\Windows\system32\OpenWith.exe -Embedding
                                    1⤵
                                    • Suspicious use of SetWindowsHookEx
                                    PID:6572
                                  • C:\Windows\system32\OpenWith.exe
                                    C:\Windows\system32\OpenWith.exe -Embedding
                                    1⤵
                                    • Suspicious use of SetWindowsHookEx
                                    PID:6988
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                                    1⤵
                                    • Drops desktop.ini file(s)
                                    • Checks processor information in registry
                                    • Modifies registry class
                                    PID:7344
                                  • C:\Windows\system32\OpenWith.exe
                                    C:\Windows\system32\OpenWith.exe -Embedding
                                    1⤵
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3084
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
                                    1⤵
                                    • Checks processor information in registry
                                    • Modifies data under HKEY_USERS
                                    PID:7408
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                                    1⤵
                                    • Checks processor information in registry
                                    PID:8016
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                                    1⤵
                                    • Checks processor information in registry
                                    • Modifies registry class
                                    PID:7588

                                  Network

                                        MITRE ATT&CK Enterprise v16

                                        Reconnaissance

                                        Resource Development

                                        Initial Access

                                        Execution

                                        Persistence

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Event Triggered Execution

                                        1
                                        T1546

                                        Component Object Model Hijacking

                                        1
                                        T1546.015

                                        Privilege Escalation

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Event Triggered Execution

                                        1
                                        T1546

                                        Component Object Model Hijacking

                                        1
                                        T1546.015

                                        Defense Evasion

                                        Modify Registry

                                        3
                                        T1112

                                        Subvert Trust Controls

                                        1
                                        T1553

                                        Install Root Certificate

                                        1
                                        T1553.004

                                        Credential Access

                                        Credentials from Password Stores

                                        1
                                        T1555

                                        Credentials from Web Browsers

                                        1
                                        T1555.003

                                        Unsecured Credentials

                                        1
                                        T1552

                                        Credentials In Files

                                        1
                                        T1552.001

                                        Discovery

                                        Network Service Discovery

                                        1
                                        T1046

                                        Peripheral Device Discovery

                                        2
                                        T1120

                                        Query Registry

                                        6
                                        T1012

                                        System Information Discovery

                                        5
                                        T1082

                                        System Location Discovery

                                        1
                                        T1614

                                        System Language Discovery

                                        1
                                        T1614.001

                                        System Network Configuration Discovery

                                        1
                                        T1016

                                        Internet Connection Discovery

                                        1
                                        T1016.001

                                        System Time Discovery

                                        1
                                        T1124

                                        Lateral Movement

                                        Collection

                                        Data from Local System

                                        1
                                        T1005

                                        Command and Control

                                        Exfiltration

                                        Impact

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                        • Size 471B
                                        • SHA256 1b25f607e2b4fb1dabb7bac8b2aafe80e792eb085d4dcc731d0f0ac74091ce4a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                        • Size 416B
                                        • SHA256 b5154648a883c11b32216cf7919032cd0f78717b75de6770e596beea716b5b29
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        data_2
                                        • Path C:\Users\Admin\AppData\Local\Opera Software\Opera GX Stable\Default\System Cache\Cache_Data\data_2
                                        • Size 8KB
                                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        data_3
                                        • Path C:\Users\Admin\AppData\Local\Opera Software\Opera GX Stable\Default\System Cache\Cache_Data\data_3
                                        • Size 8KB
                                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        129.0.5823.70.manifest
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\129.0.5823.70.manifest
                                        • Size 225B
                                        • SHA256 718b1cf8c110363b1f8eb4ebe00bcc2768ada56bf91156b2223f3e1cba07b624
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        150x150Logo.scale-100.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\Assets\150x150Logo.scale-100.png
                                        • Size 2KB
                                        • SHA256 9635c074c9d8edde0baf3111dbd7db49cbdc370c4f729c80ac382949f32be526
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        150x150Logo.scale-100_contrast-white.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\Assets\150x150Logo.scale-100_contrast-white.png
                                        • Size 1KB
                                        • SHA256 28ce8fcb22080ce1f69346cb0720bbe5662959e413426f00062b706013da8c28
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        150x150Logo.scale-140.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\Assets\150x150Logo.scale-140.png
                                        • Size 3KB
                                        • SHA256 a36a13a5d5e3d39e3018ccc5f8859944c87256f8be24a3c08a6bf3cb06a26804
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        150x150Logo.scale-140_contrast-white.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\Assets\150x150Logo.scale-140_contrast-white.png
                                        • Size 2KB
                                        • SHA256 0bd63fe653885286e180fbdf6d1dadc66af242b8ed6bd1d03d8c5eccc20e91d7
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        150x150Logo.scale-180.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\Assets\150x150Logo.scale-180.png
                                        • Size 3KB
                                        • SHA256 6a8f64754c75edcc9abc1138e44acbd7064d7e8e2a28783939241dbd6afa30a5
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        150x150Logo.scale-180_contrast-white.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\Assets\150x150Logo.scale-180_contrast-white.png
                                        • Size 3KB
                                        • SHA256 a706b332e6a846357a86c30d0e8bb7697e7dd55c2ae592dd45611ddce0c0bf14
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        150x150Logo.scale-80.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\Assets\150x150Logo.scale-80.png
                                        • Size 1KB
                                        • SHA256 7e6b0d9ea7fda1b5ca7a0b01290521dff943da4cbf1498412ca7d749db42c32d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        150x150Logo.scale-80_contrast-white.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\Assets\150x150Logo.scale-80_contrast-white.png
                                        • Size 1KB
                                        • SHA256 dfd1054f989cdee25f19ea792f363f042a125cab537a424f0224bbee13607e39
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        70x70Logo.scale-100.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\Assets\70x70Logo.scale-100.png
                                        • Size 1KB
                                        • SHA256 a333d7e4293f5269426b3fcb673a284f3708a66f957de62403b6570b24bae8f5
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        70x70Logo.scale-100_contrast-white.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\Assets\70x70Logo.scale-100_contrast-white.png
                                        • Size 1KB
                                        • SHA256 ebbe0b4761ea8968a0a3fafb383ac7ae175e98cd31a0f41bdf5fcb43469b58ec
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        70x70Logo.scale-140.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\Assets\70x70Logo.scale-140.png
                                        • Size 1KB
                                        • SHA256 207519f1c7b6c7509bfeb7b55724997eec6456c8baf55e882e72fc5cd43da221
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        70x70Logo.scale-140_contrast-white.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\Assets\70x70Logo.scale-140_contrast-white.png
                                        • Size 1KB
                                        • SHA256 464afaf960c32abdc2c3937a48bf14c5d1a819b017e719fded591d43a65d94c4
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        70x70Logo.scale-180.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\Assets\70x70Logo.scale-180.png
                                        • Size 2KB
                                        • SHA256 d6367dbc074e37f3488c26b0bad229bfe99f5c6bb0e28d37b41906c436152b57
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        70x70Logo.scale-180_contrast-white.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\Assets\70x70Logo.scale-180_contrast-white.png
                                        • Size 2KB
                                        • SHA256 5d46e4056f3915c279f1fa9edf61d93529fbcae5c59d616380ec5d9405b7763d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        70x70Logo.scale-80.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\Assets\70x70Logo.scale-80.png
                                        • Size 1KB
                                        • SHA256 dc20e5aa2b500cd5b5c9f89647d3487810685c94268f22678e27820e2454bb3e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        70x70Logo.scale-80_contrast-white.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\Assets\70x70Logo.scale-80_contrast-white.png
                                        • Size 901B
                                        • SHA256 dd6f46d32c3e235508f9e4c7d7f993bd807d955bca7e63cf3d57c6c4c102f46d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        CChromaEditorLibrary64.dll
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\CChromaEditorLibrary64.dll
                                        • Size 145KB
                                        • SHA256 580e52d1c877fe9207ec5e1b510ec0a6280ea74c42928e75255a5f605b4c60d8
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        CUESDK.x64_2017.dll
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\CUESDK.x64_2017.dll
                                        • Size 474KB
                                        • SHA256 fe5fb65ff4eb770968cd7789a4a916c0a59c083fcff5b62abdb78bf5b4253814
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        assistant_package
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\assistant_package
                                        • Size 3.0MB
                                        • SHA256 cfc2fd025bade4d21fbfc72258bac7d518f63c75ff2d05ac1cb33a1c2e0c804a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        d3dcompiler_47.dll
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\d3dcompiler_47.dll
                                        • Size 4.5MB
                                        • SHA256 86c4616f80871e4032accaaef91ce0388c9a66a037fa4346def8b2cc3fb5dc4f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        dxcompiler.dll
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\dxcompiler.dll
                                        • Size 24.4MB
                                        • SHA256 212209a3e6cdc14e72cfc19bc20836d41dd276b0e7969773e141ed1625ddcbfc
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        dxil.dll
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\dxil.dll
                                        • Size 1.4MB
                                        • SHA256 3707369845feb2452d708bbb208c7c0454f21789484a39e3c80fe4a9ca502acc
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        files_list
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\files_list
                                        • Size 4KB
                                        • SHA256 002835b79213de43863740b981fe2076fefdc40472b22cb1e32858ffb2da17f2
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        installer.exe
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\installer.exe
                                        • Size 8.1MB
                                        • SHA256 d11e54a60acfeb48fd10a0154713943022a3b73f1f0534ff65a6fd32a89d6518
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        custom_partner_content.json
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\129.0.5823.70\resources\custom_partner_content.json
                                        • Size 245KB
                                        • SHA256 84bc1efb211c6b45f2906278a36f1414922f994a9611bbee7713ffd4ae21e967
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        opera_autoupdate.exe
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                        • Size 6.3MB
                                        • SHA256 530d381f80a302cbe9ca9d19dbd7170b39953fc3ae0b7188dcfd55686f710a8f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        opera.exe
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        • Size 2.0MB
                                        • SHA256 b209e604529dbc88de40a60b39ee12350ff288d9210e39e9faf2795856afa9aa
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        +JXF12185356169693184942.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\+JXF12185356169693184942.tmp
                                        • Size 424KB
                                        • SHA256 83ff53f599acefc11f5cf63fd0516d4db72aacf7f0125a5f79c9ff222cbf9dd7
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        +JXF3877162304922845329.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\+JXF3877162304922845329.tmp
                                        • Size 477KB
                                        • SHA256 a4ece920f221b78d43b550d615c5934db162b64a331ffa663a85199e74ef2e6b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        +JXF9080753631775355260.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\+JXF9080753631775355260.tmp
                                        • Size 132KB
                                        • SHA256 9287925cae90ac480804094ff0876832065e2db116470da1f524d79ed9c18b70
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        +JXF9619436475707240865.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\+JXF9619436475707240865.tmp
                                        • Size 141KB
                                        • SHA256 b2efabca5ea4bc56eea829713706b5cd0788b82aca153bd4adde9b1573933b4f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Opera GX Browser.lnk
                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381\Opera GX Browser.lnk
                                        • Size 1KB
                                        • SHA256 7d19cd1fcd3c5a0e1291299ae983a7457e558499b60d363d339afe70bd723ea2
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        additional_file0.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381\additional_file0.tmp
                                        • Size 2.6MB
                                        • SHA256 4f3820a16ef2f8e9aaad9c64b9810445ad2b15f5654f7965e6fcb27b89382edb
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        assistant_installer.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381\assistant\assistant_installer.exe
                                        • Size 2.3MB
                                        • SHA256 cdc2495b20596a3b2d54138b5d1dc5d7492e6299be62533b06b199efda44ee77
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        dbgcore.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381\assistant\dbgcore.dll
                                        • Size 222KB
                                        • SHA256 a8e034f67477bebd9a9e0637b565c93ab7cd019f402e7e2b373ef2b32307bf93
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        dbghelp.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381\assistant\dbghelp.dll
                                        • Size 1.8MB
                                        • SHA256 4116a66a1c248ec9759e11d92a4f3c26c0317a18dd9d6cbfc9c829a2be9b9c6d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        installer_prefs_include.json
                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381\installer_prefs_include.json
                                        • Size 242B
                                        • SHA256 40ea1fbf69784552a6aca6f03f95b7ec4c38332d39c88322835c70b661d643dd
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        installer_prefs_include.json
                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381\installer_prefs_include.json
                                        • Size 923B
                                        • SHA256 d4f7190d4840406aab05d4cd6f6a47eabb2d90a092ad1223cd5fcfd3fb6a3a90
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        installer_prefs_include.json.backup
                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\f5f9e561-5ffd-4b54-8062-186ce862fe46 Opera GX Installer Temp\opera_package_202604151925381\installer_prefs_include.json.backup
                                        • Size 227B
                                        • SHA256 97331f17409895395d817dd6dab7119ff107665a9f866a3c2926bfa9ada6b1b7
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        installer.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS0222C278\installer.exe
                                        • Size 8.1MB
                                        • SHA256 d3a08718bbdaa9949a4eb74db2f302de060ba8191bdec2b08e4f0b7c350f3a98
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        200.ico
                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
                                        • Size 116KB
                                        • SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        BrowserInstaller.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe
                                        • Size 3.7MB
                                        • SHA256 e20f18d8c5d3621a81d35fe43d759ddb148e35d1856a94fbe95dfbec93127a10
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        IRIMG1.BMP
                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP
                                        • Size 12KB
                                        • SHA256 1d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        IRIMG10.PNG
                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG10.PNG
                                        • Size 206B
                                        • SHA256 348e3f3544cca4c9ca2af323fa8b3453a70ea421c82b331681dc1d4ef74921f3
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        IRIMG14.PNG
                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG14.PNG
                                        • Size 43KB
                                        • SHA256 6528bb11becf79c17c77a9c6624b82074b9dd6d3e932852c8fe1da22a57854aa
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        IRIMG15.PNG
                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG15.PNG
                                        • Size 644B
                                        • SHA256 207bd7ad2eb7f48a2a1be1253363fa120ae79e25eacbd37d6b9be52d2128bfdd
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        IRIMG17.PNG
                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG17.PNG
                                        • Size 40KB
                                        • SHA256 06fad383e3506eb1be52877bee839b833de157a2601af1c443ef1244a92f5d8f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        IRIMG2.BMP
                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP
                                        • Size 12KB
                                        • SHA256 9c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        IRIMG3.BMP
                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP
                                        • Size 12KB
                                        • SHA256 4c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        IRZip.lmd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
                                        • Size 400KB
                                        • SHA256 3a6794c90d69383bd76098992cb512ae343cb2e1a3680dd4794e49895472b429
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Wow64.lmd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
                                        • Size 252KB
                                        • SHA256 27b48727237cd0f8a1205e01e5c93cbe6c7a2f3938faf8d8daa5191094c347a5
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        irsetup.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                        • Size 1.8MB
                                        • SHA256 96070b2d82b6bffd54719f9753909be5f5151edbd5b37b26f50dea2e995ea430
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        lua5.3.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
                                        • Size 395KB
                                        • SHA256 eef58c3dae331da03872b973230aa56b40e34035035cca5b468eda0c40daa819
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        irsetup.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                        • Size 1.7MB
                                        • SHA256 ea04ee2883ca5dcb461ea894a4e2def7d0c89f11d9f06f3bae020f6a25e7b75d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        lua5.3.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.3.dll
                                        • Size 395KB
                                        • SHA256 0e43d22649d6b2ecbac9915dc6498fe1f41777dd33147d962b30dad0d5e76ab3
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        opera-installer-bro.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                        • Size 3.6MB
                                        • SHA256 1195db50d3e0e4abfac9e099cce30796613dae9e45bffde143e342e0548cc7f8
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        setuparguments.ini
                                        • Path C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
                                        • Size 801B
                                        • SHA256 4f25084771b0c773038f3f19aa8bbbc95239cd7af6b0a07f1415cf02ea73f633
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        TLauncher.exe
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                                        • Size 9.2MB
                                        • SHA256 8cdc16a8f34f99dc85273838350ae9a9a840de8c6dda3c045c5514520842dd78
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        590470ab0f17afb73a4e41d9cb56fdbe069d275a.tlauncherdownload
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\assets\objects\59\590470ab0f17afb73a4e41d9cb56fdbe069d275a.tlauncherdownload
                                        • Size 229KB
                                        • SHA256 a14d2da4f452442691791c834cf55aae43f8b435a4736eea44cb327435bca20e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        696aadb7951dc58a1d716bb033a881f65b12651c.tlauncherdownload
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\assets\objects\69\696aadb7951dc58a1d716bb033a881f65b12651c.tlauncherdownload
                                        • Size 509KB
                                        • SHA256 26e7d53cc1d26ed9d88733ba35f526ad40d0b720c4588bffbe6b2245010a8819
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        gson-2.13.2.jar
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\code\gson\gson\2.13.2\gson-2.13.2.jar
                                        • Size 283KB
                                        • SHA256 dd0ce1b55a3ed2080cb70f9c655850cda86c206862310009dcb5e5c95265a5e0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        jopt-simple-5.0.4.jar
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\sf\jopt-simple\jopt-simple\5.0.4\jopt-simple-5.0.4.jar
                                        • Size 76KB
                                        • SHA256 df26cc58f235f477db07f753ba5a3ab243ebe5789d9f89ecf68dd62ea9a66c28
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        client.jar
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\libraries\v1\objects\4e618f09a0c649dde3fdf829df443ce0b8831e65\client.jar
                                        • Size 36.3MB
                                        • SHA256 b1b3158572666445eff01e82fad8c7de2e4953db6d354f311730d77a8359d0b0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        javaw.exe
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\bin\javaw.exe
                                        • Size 39KB
                                        • SHA256 38ac81b6ef29e4f29235902fe56385e3c2e4f216f728baff9512aae4e5c7bc67
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        net.properties
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\net.properties
                                        • Size 7KB
                                        • SHA256 594bc40230a0bd7c441fe069989d66e534a6bae2ee5910f9f4bf64e59b583256
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        README.txt
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\security\policy\README.txt
                                        • Size 2KB
                                        • SHA256 6da0747334b0fea7592fd92614b2bbc8b126535e129b1fee483774d914e98eb5
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        default_local.policy
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\security\policy\limited\default_local.policy
                                        • Size 647B
                                        • SHA256 2b2627548e61316150d47ffc3e6cad465ca05b3cccd4785eb7d21aa7baa0f441
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        exempt_local.policy
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\security\policy\limited\exempt_local.policy
                                        • Size 566B
                                        • SHA256 8c3d7648abcd95a272ce12db870082937f4d7f6878d730d83cb7fbb31eb8b2c9
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        default_US_export.policy.tlauncherdownload
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\security\policy\unlimited\default_US_export.policy.tlauncherdownload
                                        • Size 146B
                                        • SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        default_local.policy
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\security\policy\unlimited\default_local.policy
                                        • Size 193B
                                        • SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        sound.properties
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\sound.properties
                                        • Size 1KB
                                        • SHA256 299c2360b6155eb28990ec49cd21753f97e43442fe8fab03e04f3e213df43a66
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ADDITIONAL_LICENSE_INFO
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\ADDITIONAL_LICENSE_INFO
                                        • Size 2KB
                                        • SHA256 a69bce275ba7a3570af6579cb0f55682cd75fedfcd49e0e8e9022270c447c916
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        LICENSE
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\LICENSE
                                        • Size 18KB
                                        • SHA256 4b9abebc4338048a7c2dc184e9f800deb349366bdf28eb23c2677a77b4c87726
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        aes.md
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\aes.md
                                        • Size 1KB
                                        • SHA256 45c6d4da48325edfbff3dcf71c704e504c057904435ed23c6d57046d551eb69d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        c-libutl.md
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\c-libutl.md
                                        • Size 1KB
                                        • SHA256 bef40679922d6fdfb7e4ddb223ad6722300f6054ba737bbf6188d60fcec517f9
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        siphash.md
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\siphash.md
                                        • Size 8KB
                                        • SHA256 5a792b5a74ad2a5f3d6a7ad8b7a841116e58a772c18bc6e392320a365b222c76
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        wepoll.md
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\wepoll.md
                                        • Size 1KB
                                        • SHA256 3ac2992770080453b98c42afa807ba4b2c1738ef756b92a55c645f55e7df48f0
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        zlib.md
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\zlib.md
                                        • Size 1010B
                                        • SHA256 809b62ba648e02302f7d9ea6b6886c10d5253ac86ad528038a50c73eada5fce2
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ADDITIONAL_LICENSE_INFO.tlauncherdownload
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.compiler\ADDITIONAL_LICENSE_INFO.tlauncherdownload
                                        • Size 48B
                                        • SHA256 d255311b0a181e243de326d111502a8b1dc7277b534a295a8340ab5230e74c83
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        ASSEMBLY_EXCEPTION.tlauncherdownload
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.datatransfer\ASSEMBLY_EXCEPTION.tlauncherdownload
                                        • Size 43B
                                        • SHA256 7901499314e881a978d80a31970f0daec92d4995f3305e31fb53c38d9cc6ec3b
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        LICENSE.tlauncherdownload
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.desktop\LICENSE.tlauncherdownload
                                        • Size 32B
                                        • SHA256 d60635c89c9f352ae1e66ef414344f290f5b5f7ce5c23d9633d41fde0909df80
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        colorimaging.md
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.desktop\colorimaging.md
                                        • Size 167B
                                        • SHA256 04d61e3e8e71dd452ebe52008af5378d9f6640d14578aeb515dc5375973b0189
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        harfbuzz.md
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.desktop\harfbuzz.md
                                        • Size 3KB
                                        • SHA256 b3f327a8b36d56beb152b3fd1bb5a7f245362cbea123ebbc68f8907f741b552a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        jpeg.md
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.desktop\jpeg.md
                                        • Size 3KB
                                        • SHA256 c1dfb9719a71ad9f861f8728550542d681e25c8ef40e6393606e6e2a0c1d653a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        libpng.md
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.desktop\libpng.md
                                        • Size 7KB
                                        • SHA256 4e4c0ecd9795b9181538ea94fa63e6817e6e1f4b51481d720adaee0fde409c20
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        mesa3d.md
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.desktop\mesa3d.md
                                        • Size 5KB
                                        • SHA256 63f4e6f75caebbccb95d903fb43e46ac7111b3624d0a34f146b276d7d9e7b152
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        santuario.md
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.xml.crypto\santuario.md
                                        • Size 11KB
                                        • SHA256 d08690d25f660f145c73365d260ed522cd0aace8a0e1396706551b7a1ae8c9a3
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        bcel.md
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.xml\bcel.md
                                        • Size 10KB
                                        • SHA256 853a1e7ce397bb10de0e2b3bde0844bcc651f17d983decd07d2d003c0304c311
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        dom.md
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.xml\dom.md
                                        • Size 3KB
                                        • SHA256 6686e8877667584a3a7c07344baadca1a03e29f677162d87c3c0811e990d1148
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        jcup.md
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.xml\jcup.md
                                        • Size 1KB
                                        • SHA256 8d5dcfdf50455a3c34c753a98f21e953248af200415a9084e3f102cb6c43b8bf
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        xalan.md
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.xml\xalan.md
                                        • Size 13KB
                                        • SHA256 02bd013fc3f438dbb8fa41fa57888177e015efa6431d37fce6e794c6f353a6a1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        xerces.md
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.xml\xerces.md
                                        • Size 11KB
                                        • SHA256 4a6bf6b367193ee68681cb2d9fed30ffc5d62dd2d477bd62e0271707d71b3244
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        pkcs11cryptotoken.md
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\jdk.crypto.cryptoki\pkcs11cryptotoken.md
                                        • Size 3KB
                                        • SHA256 1f36ff1342a581142c858f90064e20633d43529ac82adb85345bd902a14e18b2
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        pkcs11wrapper.md
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\jdk.crypto.cryptoki\pkcs11wrapper.md
                                        • Size 2KB
                                        • SHA256 371974b1fca3744a3892c7ee1fcc593b8b4281fc218f4cafd2f709e9df5fd81d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        fontconfig.bfc
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\lib\fontconfig.bfc
                                        • Size 4KB
                                        • SHA256 c7e2e76b908cb6330823e698889943c162e9861a4575501cbb59c9b830158ab0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        jvm.cfg
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\lib\jvm.cfg
                                        • Size 29B
                                        • SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        tzdb.dat
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\lib\tzdb.dat
                                        • Size 100KB
                                        • SHA256 7be2a3adf10ff841579629f7725b15f0db41e8856527ec72847b5477073a3d29
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        glfw.dll
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.1.2\natives\glfw.dll
                                        • Size 521KB
                                        • SHA256 b0548e974e03b1bb597f9696b3f9d75df66af3cbea0b8246adcb2c79de0653af
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        jemalloc.dll
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.1.2\natives\jemalloc.dll
                                        • Size 390KB
                                        • SHA256 557cc5f6dc2e7b410111afe83a11f3a8da8963ca8eddf0c542559329cbc0a5c2
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        lwjgl.dll
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.1.2\natives\lwjgl.dll
                                        • Size 509KB
                                        • SHA256 6a1469be51e2fa8be8c70d8aa7bcaa4a1704055c62291490ea453f3ce3128377
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        lwjgl_tinyfd.dll
                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.1.2\natives\lwjgl_tinyfd.dll
                                        • Size 249KB
                                        • SHA256 a68bca84a9f40b8059db58042db3271a6dfea76826162d4103be6916cc6905b7
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        InnerStateServer-1.3.json
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\InnerStateServer-1.3.json
                                        • Size 2B
                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        IRIMG1.PNG
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.PNG
                                        • Size 45KB
                                        • SHA256 a42ab4d62c5a5286202df15f9ad32b22396d5d12c7a4db8c5a2c98f90160ade1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        IRIMG13.PNG
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG13.PNG
                                        • Size 41KB
                                        • SHA256 1708790d5496b9cc325cc0249cfa272aac3c3738188fc41eef83e8592de247ff
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        IRIMG3.PNG
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG3.PNG
                                        • Size 475B
                                        • SHA256 d339d7a5fcaff72292150f3c7db87a73caa396e23224b570e053c8bb96a3a897
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        IRIMG4.BMP
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.BMP
                                        • Size 451KB
                                        • SHA256 64da5bd044908b2c3a725c5a55edec1644be498f41ea05d42a6ae8cd797f1d80
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        IRIMG4.PNG
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG
                                        • Size 368B
                                        • SHA256 3207283d0abc0dd36c0991b40a738247394bbc92e5696eb790a5c888a9f28106
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        IRIMG9.PNG
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG9.PNG
                                        • Size 438B
                                        • SHA256 d16a8eaf8f979e45bacbbd8ef14afe482d74e926dff2e87e569342874ba34145
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        uninstall.xml
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                        • Size 21KB
                                        • SHA256 21587b5ce0ca69fec2590574885df2032163acb1c9e887f8154b2f47bd2f73e5
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        uninstall.xml
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                        • Size 8KB
                                        • SHA256 a8f70a5b37d924367b6f71d91a412e8d61fa85353d0a83c54663a605b0426f00
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        version_manifest.json
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_launchermeta.mojang.com\mc\game\version_manifest.json
                                        • Size 196KB
                                        • SHA256 520210d484f6bbd54a49ebaab7a60f1fb86535eeaefee2a96c243d0f5ac06852
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        30.json
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_piston-meta.mojang.com\v1\packages\079069a1fe7d4a5873fc22949aa4a1daeb005816\30.json
                                        • Size 534KB
                                        • SHA256 c9508f6b627a82402d2c957b64d4ae7ca2d5ebd23c72f5bcbc8b5db71cc8e1a7
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        manifest.json
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_piston-meta.mojang.com\v1\packages\b374544c680d965fb5535977d7cb04c6befe1930\manifest.json
                                        • Size 149KB
                                        • SHA256 fcac80eeabd7f68b10136286493f633d043e5804ff4fa1692e654edd129c5853
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        26.1.2.json
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_piston-meta.mojang.com\v1\packages\e769ea3cbacbb342fcb6311842b3351a1d374506\26.1.2.json
                                        • Size 41KB
                                        • SHA256 df223fdd4c07f093d9d54c9e30aa78b54ce8a7b6f43bff0f21bdf783b711aae8
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        inner_servers-1.2.json
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tlauncher.org\update\downloads\configs\inner_servers-1.2.json
                                        • Size 7KB
                                        • SHA256 6b411ff24a9c61c2ce2649de3ec798d07ee16e2880630048bfc05dd381bc43b4
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        index_en.html
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tlauncher.org\update\downloads\configs_v1\pages\index_en.html
                                        • Size 42KB
                                        • SHA256 330dcb7a59b16f6aba4ccd57f1d794a11ead469ec4e3679787887c612560690b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        libraries-1.7.json
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tlauncher.org\update\downloads\libraries\org\tlauncher\authlib\libraries-1.7.json
                                        • Size 360KB
                                        • SHA256 ffc83bac32c39927275acc203d6623b96aa26dbd6d39801b69a7a3c9ab00ea56
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        additional_assets-1.1.json
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tlauncher.org\update\downloads\versions\new5\additional_assets-1.1.json
                                        • Size 190KB
                                        • SHA256 12ea0578ab812f6e6730ea5b23e7f8bfcbaec59e801b8699abc1e773a3b7476b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        version_manifest.json
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tlauncher.org\update\downloads\versions\new5\skin\versions\version_manifest.json
                                        • Size 12KB
                                        • SHA256 1ffa4ad1bd60820559a2dcd575258d3f486f75d18c30cee59787ff190b07d976
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        version_manifest.json
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tlauncher.org\update\downloads\versions\new5\version_manifest.json
                                        • Size 48KB
                                        • SHA256 69783210cdfe3e9d1ecd7c89faf6e09d8710da9bda88da9f170dd030de654d86
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        additional_hot_servers-1.0.json
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tlauncher.org\update\lch\additional_hot_servers-1.0.json
                                        • Size 20KB
                                        • SHA256 d97f7c342ea56c59823b292f139c8b255d4b2e6a3867999a6a165292ed7ddad3
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        hot_servers-1.0.json
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tlauncher.org\update\lch\servers\hot_servers-1.0.json
                                        • Size 49KB
                                        • SHA256 6638a18361df5f6e289251cc1ba97c311d868b5ddf5bc4b2a941fb7fa2e10f81
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        java_configuration.json
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_rescl.tlauncher.org\b\jvm\java_configuration.json
                                        • Size 13KB
                                        • SHA256 b490908c9bda7f4ed5220145dee8dd1ee9ad92a210080adec3c183b0f0a50a8b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        dependencies.json
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9361\dependencies.json
                                        • Size 25KB
                                        • SHA256 3f5bb10fc9289aa79999e062d9bf0a30675ae726bf68e36d3b7c31c917d298bc
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        resources.json
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9361\resources.json
                                        • Size 17KB
                                        • SHA256 e534cd0360f57e950e52406b330a77cbc4f486a690fb7ef7b295e4811cc7154d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        appConfig.json
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\appConfig.json
                                        • Size 4KB
                                        • SHA256 4991514f39f5e4f924690f6eb6db80e3689195aa3224699a4f881a8a01a6e86f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        javaConfig21.json
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\javaConfig21.json
                                        • Size 3KB
                                        • SHA256 dc81ccb8306bbf45e47d5d4b7348289e7ae5134980f8787fbd287180346c9a33
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        starter-core-1.266-v2.exe
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\update\lch\starter-core-1.266-v2.exe
                                        • Size 9.2MB
                                        • SHA256 72cea0ffd2a5bbcb7a87f396456a8a1ceaa558748b48187004dc03869e892989
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        COPYRIGHT
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.91-windows-x64\legal\java.logging\COPYRIGHT
                                        • Size 35B
                                        • SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        LICENSE
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.91-windows-x64\legal\java.logging\LICENSE
                                        • Size 33B
                                        • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        ADDITIONAL_LICENSE_INFO
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.91-windows-x64\legal\javafx.web\ADDITIONAL_LICENSE_INFO
                                        • Size 51B
                                        • SHA256 0a256a7133bd2146482018ba6204a4ecc75836c139c8792da53536a9b67071d4
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ASSEMBLY_EXCEPTION
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.91-windows-x64\legal\javafx.web\ASSEMBLY_EXCEPTION
                                        • Size 46B
                                        • SHA256 a4b7ad48df36316ddd7d47fcecc1d7a2c59cbfe22728930220ef63517fd58cb0
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        LICENSE
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.91-windows-x64\legal\javafx.web\LICENSE
                                        • Size 35B
                                        • SHA256 01a4ebd2a3b2671d913582f1241a176a13e9be98f4e3d5f2f04813e122b88105
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        tlauncher-2.0.properties
                                        • Path C:\Users\Admin\AppData\Roaming\.tlauncher\tlauncher-2.0.properties
                                        • Size 1KB
                                        • SHA256 170a20fb2bb3901e66276e62246cc48d2835d781df10184ba12bcb69e52be7be
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Opera GX Browser.lnk
                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera GX Browser.lnk
                                        • Size 2KB
                                        • SHA256 d263b3d628289ffc5cc4716c9b8ca348a7e3b0e98f2619775dbe13bfe375418e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        settings.dat
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
                                        • Size 40B
                                        • SHA256 e59c361fbe4e314bdb0b7e8ff6dbf73253b0d31a2f06c3a4c855161f72b6b7e0
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        the-real-index
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
                                        • Size 48B
                                        • SHA256 7052831090edf3cf04b82dad868829afec9682410b2c6952178ff75923934ae4
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        the-real-index
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
                                        • Size 312B
                                        • SHA256 dd83797d3d02c4f4b83a6b0a2be80a264883d6a6853663c63b2955bb192855eb
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        index
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\DawnGraphiteCache\index
                                        • Size 256KB
                                        • SHA256 53d5e4cecbad7a3a13380b20e565240ef4d213db598fe17fae76ad37ae08b27e
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        MANIFEST-000001
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extension Rules\MANIFEST-000001
                                        • Size 41B
                                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        the-real-index
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                        • Size 48B
                                        • SHA256 abf55fdbf7a285acb57721530cd3f4ef1d442c4cc0d15620fde01c12f3248a3d
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        the-real-index~RFe58bf44.TMP
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bf44.TMP
                                        • Size 72B
                                        • SHA256 3e8c0d8545b62a57588d9356f7f5e091b951334d797965c79379296e635a6ca4
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 2368019f093aad9736e2edf77b97f71b5c1e76d91e1423f99ab7b8737c02e840
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 2345fd6222a71e1b4ce68bf798c6ca9d2fece7fb901425eac94dd4f0000b790b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 2KB
                                        • SHA256 30be7a53ed5cd47dc9161766af7c0f3a04cffedfbab1e0e60b5c3ece7e6a9d48
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 10KB
                                        • SHA256 77499e9fbc109ce425c28ae0c213c8a801c363f0b9b27840b51681d3b147750f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 8KB
                                        • SHA256 4ff31b99ed1c7e1314a99a102cc19c9bce3b5fbca75ddc3366fc47c0a7b31700
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 c722bd8b9418dac54d7d999af2a769d6a8d11b7a21175c162b6dbcfa03a8b921
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 0b263c1e1c1a092bdad307314b7012c9ca2b3eb4eac9f7e48eac34d34516202b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 e381c0903c53a7355e6666e064dac8a3a40087f429ec26df4b6e9a3885f9c3b1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 4c8d1de3730e6e9753402a17f1e39cef3c273dc6aab0ac26235211f9736628e6
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 20287ec965ad7e568225dae4c9d3d8366d35e977626ab4bb1b46e10f525572e2
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 a74ed647b84d1849b1c88e44c970119fa8712a01df429a1b93b59c85c9a2fbf4
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 83f1033ddb233a13102d6c69140199bde801ae62694c0d7db6386533fc7a98f6
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 a29d2ec6b16629af3918067b5290a2fe2fc384b8102990140773cd7f33ca5586
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 7b3d77513d6fd2a2335db3670aa59378f3cd5738e9e805080bb39e4b5c78a38a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 44fb4b0be311505293e98b1a1682618cf45da13a07ca92f25497161e7005fd32
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 0d5035fdecd69ceed802256155473999597a193634312eb4f51f9a57e588e2a1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 7d183bfe79009d4ac5997381aba657de1f3721068761432ddef4e23eb922f3b8
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 8673569f61742686cac7ab8e56650039dd601f2e71530b87ef832e6cbf091711
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 253c2b6c92b7be16416d570b82ec402f8e51b91fe063fe078ff826b9a90bd82c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 d2d55396e5d6ca9f6761ca81684197d2a2f9c14ffd4b173d70989f339df3b473
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 8c0c11d1704f076201ce4a02ec5360894c991d1b3e2b9027c395838109e54f60
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 e625fdd6d2ecfecd462873b25b54cf76f8e84516324a4c82dbb84a6d673eee69
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 10KB
                                        • SHA256 b12e4c80736d17d1d688c99a374872ac1f81b95cd4d6db0f32ffa248975e78b0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 10KB
                                        • SHA256 fbe813b8d8f12f9de0ad12865f3644df3faa929ecb7411c3f64ce4cc1aeca16a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 10KB
                                        • SHA256 498b3a39a2a8b682268e3b5718b9d60e9775bda005c74d964998da42309bf876
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 493B
                                        • SHA256 95c77fb48a1cc35508bca071bbc2c76410c2dbc34ebb9302d37529b0e718a630
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 1KB
                                        • SHA256 493103db669d98534f2ce0a73f3a339ed377f8a7d1c62e1b85f762a38397614b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 8KB
                                        • SHA256 bd80fe54db8826275cee41de318deee5611ac514ba339f46a575d25d92c5659f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 10KB
                                        • SHA256 10b43930275ba18e7f354cb2b181757844f56f05d2183e7e1ffbcc9aa3df3351
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 8KB
                                        • SHA256 33c4a8bc98bd6534ec97c99ce301a25618ecd9cb167100be5636a466cbc987da
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 8KB
                                        • SHA256 e2f661cd004b3f5b0825d5d7d3b41d42ab3717d24ae19832533da0b17d42ee97
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 10KB
                                        • SHA256 d0dfc88f22f559a247b58f9fdd2aae12a32d05708cfadab01611895b57d5242a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 8536568dbdf531d1447815c7105ea7e36060ab849b8aa7b950ab72359a33b897
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 36d09f7d04b61f74916aad9fe06fc7e06584b9f504e76fe44705f84f0e22b0a3
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 653B
                                        • SHA256 8b77089d0657865da342ee6884c82598cb27f14fe93313b7cd9066420d770f18
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 781B
                                        • SHA256 10f17d3846c0b03eb69520335afcf7ca8c4ef71e6c44eabc6b1e119baea9a525
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 925B
                                        • SHA256 883a60c560fce9c98b5516c895bc94143a755fee4238f9f1261cb8b79a3ee687
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 1KB
                                        • SHA256 a540b46fa0566990659396649a4d6bf4e9c3f92d0157549bf6014f898215642d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 1KB
                                        • SHA256 5778589afa266a24b7fef742fdecc373e5b3df26cfaabd70ceea50a7aa2be733
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 1KB
                                        • SHA256 6667b84d59c69c8be4231c0cb7f478c4d7b56bb442c29080e16fd27780cd411a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 1KB
                                        • SHA256 8f916285313f77545cef4c7c57921710dfcf136af530280462c77a454f590e4b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 1KB
                                        • SHA256 21bcb7b54f99cce3cc29ef8d4c689b8d18ff92aabb934eed3ac56a8bd301777f
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 1KB
                                        • SHA256 a95562799526b29866790ad7f4ab9077fb70862ef968461393a2e13b03ad5e9d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 1KB
                                        • SHA256 44dfd074ce565a264703e50ea8cb29240092530212488852a98bfca2e49bdeba
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 2KB
                                        • SHA256 214ae21a0b9b8d312e5736aa3f12472c4c3ee39028a4c77eacafb576a62d012a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 2KB
                                        • SHA256 41143e3e548ec851f26baf7362777a79d963d3071cea23616eb9eaab37091cc4
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 2KB
                                        • SHA256 37562bbd101a19877a2e46d001c3f2126cb92606b4420fb4de61348a2511dcf0
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 2KB
                                        • SHA256 eaffc407a627dac58710dd1cc1243c9532dee1e35651470557ad775d892c9337
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 2KB
                                        • SHA256 6724bc2022f20116b483f24c5ba06be13a398c75c501cbc9be1f62b65b221127
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 2KB
                                        • SHA256 15869eff0dc8da91011b6b92237b41f00dc7daaa2416b5d256529ada1ef1556b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 10KB
                                        • SHA256 73a65dae481aab2da68c5151e49e053e8ce03f8b7a196a22e9178d023d5e3437
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 2KB
                                        • SHA256 5e3bcb87bf793056a9e4f4b25e327c88b0682565e1c1c209d324b38d42d0aa14
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 2KB
                                        • SHA256 8be10b536a6ba6e06882e513ea3c6aa1fea8bb788bd319753194d2b00919bd31
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 10KB
                                        • SHA256 6aa38b04594b45ead393e29f8efdff410d33a2d817fd6e9a838daed66423eb43
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 10KB
                                        • SHA256 191017bed6d0e8aa554601a07afb52a0756cf4cacbb6bd57af97f4ce4d57fc30
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 8KB
                                        • SHA256 49462e0ba09b99356813b787aca632fc047bbe4a1d2e1b454a31998a659a6467
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 8KB
                                        • SHA256 d36e5184061dea86271c70a4b0bd73d0b071fbf5c0f1f2b62a45545063f1b76b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 9KB
                                        • SHA256 65bf63d84906fd8f643fb9990c02d7302f923a9932ce9ccf73b125161beca23a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 10KB
                                        • SHA256 f875a75a52adedf2e691dd5229a290d1ac02fa2288f8b6fdb6d85b40d429ef26
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 10KB
                                        • SHA256 31dfe1594bdadd2c7edfa49b00960f795e4cead95db381fc75a6e4d8080dc917
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw
                                        • Size 10KB
                                        • SHA256 38a71c9f78631a4e5047c7add2cce2ad1ad93ae9762b14a15608eb1ec92aecc4
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw~RFe58b0cd.TMP
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fa6e2e2e-dbac-41c0-8b82-62f635ebab37.raw~RFe58b0cd.TMP
                                        • Size 381B
                                        • SHA256 71d04a63d7c0acf5412f9737f4a8dc6e799881dfe50b321f555276bc18953dbd
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        CURRENT
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Sync Data\LevelDB\CURRENT
                                        • Size 16B
                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        c9e7f4be-b575-4686-983e-3fc829439d1d.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\c9e7f4be-b575-4686-983e-3fc829439d1d.tmp
                                        • Size 162KB
                                        • SHA256 655050396cfac8e23abeed21171996030b98d079090918ccf869830caa20cf6b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        e90435e2-43fc-4a08-9f71-ddb8f07a495f.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\e90435e2-43fc-4a08-9f71-ddb8f07a495f.tmp
                                        • Size 15KB
                                        • SHA256 96c2abff70430fcfc59a4e9f9604a99c97ad82c2b218871ad9d0b38f038de2e9
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 1KB
                                        • SHA256 922dd7c8a4b26ffc32ebf447f0cfed194725c732463a5f0e5713412a4f6e9c44
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 505B
                                        • SHA256 0c25d766d2fe4c87285ea0f6ee0a43c74fe38ab1b9d6050a8f3228a4ea357d1f
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 597B
                                        • SHA256 a589faaa2f89499c4cd587540d1111cecbd5927b9bc57552f63bf4daae3a5cd3
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 869B
                                        • SHA256 f155374150b53f6950b10d8d79f24da9d664f69d6335d6b989ea18d0a103abf8
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 970B
                                        • SHA256 90bca95f7bebbb4c93a30ce3d37ed19280458fa400006c9109d778a305fab115
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 1KB
                                        • SHA256 1bb7077cd711b6075242afe8b5d9107a4892f4d690f579e8eab98e30dc010c01
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 1KB
                                        • SHA256 76020c13f84ee43caacc09141a9fe2eeb1efab215c800747064496359e2dab1d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 1KB
                                        • SHA256 7198630e13f6f04c81e5225f0cadcfd515971846e84e9b9200251b2381c7a18a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 1KB
                                        • SHA256 a34ea8303221ff4a0873430eb8cae6e8c4d5a6876f44e205286050aee1396971
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 1KB
                                        • SHA256 35032da02f2d49aaca930a967bd27a670a247a150157bd6fdc1055f9a0cf28a8
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 1KB
                                        • SHA256 f604127942729e3461bd6c32096792ad56d86ed6a7f0b261bf3a0e78e266fa49
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 2KB
                                        • SHA256 915ab8ede642bf7db28f6b876a675cda1c39a2717e006dbb6fa3efe1d2710e76
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 3KB
                                        • SHA256 cc0101eb9d25643d92e5fc2b360bd44963367438f6524dc01f175367a5bbf106
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 3KB
                                        • SHA256 a6fc1d55b429f8fd1c7b58245eec492d7caec6516cbea5561ff5f5aeb6ca509b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 3KB
                                        • SHA256 8eaacb6a11e1164ccef192f219ddcb87fbca71d4c16487a2d6b586cc37ccee24
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 3KB
                                        • SHA256 8025226ee53ea39493627e89f00c8e2819b94e5814990e792b98ddb8136fb5f7
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 3KB
                                        • SHA256 35e03a88aa79ca1603619e65d282e1979af880d908e2adb14ab0350f30bcb3b2
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 3KB
                                        • SHA256 b868c87f2ae80f150c0f6004e54fdcb0c692274829e25f649391fe7e4037eb9b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 3KB
                                        • SHA256 d1e23c06cd227b03db1fb0a414ee48471aaf47e505414c17941f35b405f78877
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 4KB
                                        • SHA256 7e4e2c2a745c70e9998763b5a5c92aa428bf822d519d71178fdd9bccbe7bed6c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 772B
                                        • SHA256 00ebc9b382e186dcf640f92eac0ff43a2b7da4aee01d7608f71d5abbcd4e2b56
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483
                                        • Size 683B
                                        • SHA256 480d7dcfd51db6eae7809fc902dacf4f64f680c9b207ce64516b6bac6bd7627a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.0.1737056483~RFe58bacf.TMP
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.0.1737056483~RFe58bacf.TMP
                                        • Size 412B
                                        • SHA256 dda9a21f3b6cffeb1d73304c40fae9e612531cbf294d50862ad0a15c7851475b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.1.516782531
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.1.516782531
                                        • Size 298B
                                        • SHA256 3c19d8b50a1020ca098c522256800b78648577a0f0a8d98c41239ee64752f509
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.1.516782531
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.1.516782531
                                        • Size 2KB
                                        • SHA256 18d9f7c1596ead9e41b008b4d69c02852ffa59538df2709be0dd49ff91980c28
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.1.516782531
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.1.516782531
                                        • Size 2KB
                                        • SHA256 7e297cb0a97bcbc197c578c91cbcdec790bf5ca7faf644ff972ca343eb08780d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.1.516782531
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.1.516782531
                                        • Size 2KB
                                        • SHA256 bc4096491302dd6f8849addb160becf0919165c39f50a740ff8112b4acad7c3e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.1.516782531
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.1.516782531
                                        • Size 2KB
                                        • SHA256 688971be8b374e4c4ee8cc7f66fed4ad518fbd6b9dd2a8fb8e39f94c91cf82b6
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.1.516782531
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.1.516782531
                                        • Size 2KB
                                        • SHA256 0d603bd50de4465a2b4235f3f94c21a3f42543a3ace9ddb593e63d45dbee8f80
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.1.516782531
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.1.516782531
                                        • Size 2KB
                                        • SHA256 b894b1616949debc7f3d4f8c8b347b5da8d79f65d9818429872734e29685d278
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.1.516782531
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.1.516782531
                                        • Size 2KB
                                        • SHA256 d7727da141e886b5f52b6e87d2cdb3b7c0a1345f195e3c8751ca934b3f063f30
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.1.516782531
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.1.516782531
                                        • Size 360B
                                        • SHA256 11751aac88d9e89fe4a11d03a8297aae6a756bcc5a1471252296b39c669260a7
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.1.516782531
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.1.516782531
                                        • Size 200B
                                        • SHA256 532014947af13f39c378bbd93177d8a4cd586972ffa8f99743838bfa8cd8abc8
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.1.516782531
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.1.516782531
                                        • Size 2KB
                                        • SHA256 4eccf7cd13c0e57a9edc62490c9a124db2b6029b97d9cfb4f9e06a69aa48d6ca
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.1.516782531
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.1.516782531
                                        • Size 1KB
                                        • SHA256 3eb2b13f507d1224eb04c6011e2285dca4976f269101824c1294abde9058f853
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.1.516782531~RFe58bdbd.TMP
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.1.516782531~RFe58bdbd.TMP
                                        • Size 171B
                                        • SHA256 cd6d3a58867671c0fa5567c48f2c2d0f0749f5412bc29900b6787027a7905310
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.2.1739695125
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.2.1739695125
                                        • Size 217B
                                        • SHA256 5c6c06d229e4de1efda2c130a250ab9b4a9ecf152b50df8a9848b7bc1c9259b4
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp1300.2.1739695125~RFe58bf44.TMP
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1300.2.1739695125~RFe58bf44.TMP
                                        • Size 173B
                                        • SHA256 ce7997b819e5edcef6f381de37342c15bf4bf84332d8a15df96b1ea5fbccdef3
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        data_0
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_0
                                        • Size 8KB
                                        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        data_1
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_1
                                        • Size 264KB
                                        • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        assistant_prefs.json
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\assistant_prefs.json
                                        • Size 151B
                                        • SHA256 f60e0b22ee95946685ae6a4effc1c27ae103e2a9648d678ae7fad8d7a7b998f3
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        assistant_prefs.json~RFe58fe8f.TMP
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\assistant_prefs.json~RFe58fe8f.TMP
                                        • Size 151B
                                        • SHA256 b3fe3d53f47db4c5e2762f3514408627b7327dc5f2277530790ce6e2b1b16620
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        desktop.ini
                                        • Path C:\Users\Admin\Videos\Captures\desktop.ini
                                        • Size 190B
                                        • SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        memory/948-3296-0x0000015393EE0000-0x0000015394258000-memory.dmp
                                        Download

                                        memory/1300-3375-0x0000016DDCD20000-0x0000016DDD098000-memory.dmp
                                        Download

                                        memory/1328-3310-0x000001F3F6260000-0x000001F3F65D8000-memory.dmp
                                        Download

                                        memory/1584-3374-0x000002198FAD0000-0x000002198FE48000-memory.dmp
                                        Download

                                        memory/1800-1890-0x00007FF8C7A40000-0x00007FF8C7A41000-memory.dmp
                                        Download

                                        memory/1800-1889-0x00007FF8C7C90000-0x00007FF8C7C91000-memory.dmp
                                        Download

                                        memory/2172-1980-0x0000024AE9620000-0x0000024AE9998000-memory.dmp
                                        Download

                                        memory/2300-3376-0x000001D18AC20000-0x000001D18AF98000-memory.dmp
                                        Download

                                        memory/2316-3306-0x000001EFBAE90000-0x000001EFBB208000-memory.dmp
                                        Download

                                        memory/2316-680-0x000001EFBAE90000-0x000001EFBB208000-memory.dmp
                                        Download

                                        memory/2328-679-0x0000017824E90000-0x0000017825208000-memory.dmp
                                        Download

                                        memory/2456-1854-0x000001E4F00E0000-0x000001E4F0458000-memory.dmp
                                        Download

                                        memory/2484-3312-0x000001DE1E4D0000-0x000001DE1E848000-memory.dmp
                                        Download

                                        memory/2956-788-0x0000000000F40000-0x0000000001541000-memory.dmp
                                        Download

                                        memory/2956-1836-0x0000000000F40000-0x0000000001541000-memory.dmp
                                        Download

                                        memory/2956-1838-0x0000000007F60000-0x000000000801F000-memory.dmp
                                        Download

                                        memory/2956-674-0x0000000000F40000-0x0000000001541000-memory.dmp
                                        Download

                                        memory/2956-675-0x0000000007F60000-0x000000000801F000-memory.dmp
                                        Download

                                        memory/2956-579-0x0000000000F40000-0x0000000001541000-memory.dmp
                                        Download

                                        memory/2956-14-0x0000000000F40000-0x0000000001541000-memory.dmp
                                        Download

                                        memory/2988-650-0x0000014DB7420000-0x0000014DB7798000-memory.dmp
                                        Download

                                        memory/3372-681-0x0000019DAAE60000-0x0000019DAB1D8000-memory.dmp
                                        Download

                                        memory/3376-3377-0x000001FE1AE90000-0x000001FE1B208000-memory.dmp
                                        Download

                                        memory/3404-3340-0x0000020D4A4F0000-0x0000020D4A868000-memory.dmp
                                        Download

                                        memory/3460-1834-0x000001F781340000-0x000001F7816B8000-memory.dmp
                                        Download

                                        memory/3536-1828-0x000001A301010000-0x000001A301388000-memory.dmp
                                        Download

                                        memory/3788-617-0x0000000000BF0000-0x00000000011E7000-memory.dmp
                                        Download

                                        memory/3788-676-0x0000000000BF0000-0x00000000011E7000-memory.dmp
                                        Download

                                        memory/3788-3503-0x0000000000BF0000-0x00000000011E7000-memory.dmp
                                        Download

                                        memory/3788-1940-0x0000000000BF0000-0x00000000011E7000-memory.dmp
                                        Download

                                        memory/3848-1843-0x000001F6E15F0000-0x000001F6E1968000-memory.dmp
                                        Download

                                        memory/3964-3175-0x000001920B0A0000-0x000001920B418000-memory.dmp
                                        Download

                                        memory/4376-678-0x000002429BA40000-0x000002429BA4C000-memory.dmp
                                        Download

                                        memory/4376-677-0x0000024299DB0000-0x000002429A128000-memory.dmp
                                        Download

                                        memory/4792-3040-0x000002221D630000-0x000002221D9A8000-memory.dmp
                                        Download

                                        memory/4812-1848-0x0000026003530000-0x00000260038A8000-memory.dmp
                                        Download

                                        memory/4876-1803-0x0000000000400000-0x0000000000420000-memory.dmp
                                        Download

                                        memory/5484-3267-0x000001F651000000-0x000001F651378000-memory.dmp
                                        Download

                                        memory/5632-3295-0x0000000003F30000-0x0000000003F50000-memory.dmp
                                        Download

                                        memory/5632-3294-0x0000000003F00000-0x0000000003F22000-memory.dmp
                                        Download

                                        memory/5732-3327-0x000002BE5F1A0000-0x000002BE5F518000-memory.dmp
                                        Download

                                        memory/5808-3174-0x0000017D139C0000-0x0000017D13D38000-memory.dmp
                                        Download

                                        memory/5988-2856-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-2296-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-2855-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-3214-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-3373-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-3213-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-3120-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-3152-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-3158-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-3082-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-2850-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-2845-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-3292-0x0000020F6D3D0000-0x0000020F6D748000-memory.dmp
                                        Download

                                        memory/5988-2854-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-3223-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-3240-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-1849-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-3277-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-1842-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-3276-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-3280-0x0000020F53490000-0x0000020F53491000-memory.dmp
                                        Download

                                        memory/5988-3293-0x0000020F6EBF0000-0x0000020F6EBFC000-memory.dmp
                                        Download

                                        memory/5996-2842-0x000001AB6C520000-0x000001AB6C52C000-memory.dmp
                                        Download

                                        memory/5996-2840-0x000001AB6A760000-0x000001AB6AAD8000-memory.dmp
                                        Download

                                        memory/6040-3378-0x000001D1047A0000-0x000001D104B18000-memory.dmp
                                        Download