Overview

overview

8

Static

static

3

exe.exe

windows10-2004-x64

8

exe.exe

windows11-21h2-x64

5

Analysis

  • user interaction
    yes
  • max time kernel
    231s
  • max time network
    272s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/05/2026, 16:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    exe.exe
  • Size 5.9MB
  • Sample260524-txl25set8z
  • SHA256 cace8e3e89804a05a1aaf1579a9cc5b8e2b5a957bd4cdde9b043838ab6dd604c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Signatures

  • Downloads MZ/PE file 3 IoCs
  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 42 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 53 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\exe.exe
    "C:\Users\Admin\AppData\Local\Temp\exe.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4060
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      2⤵
        PID:4368
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3828
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb365bc728,0x7ffb365bc734,0x7ffb365bc740
        2⤵
          PID:3664
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,14134300680504845372,4451729878403236113,262144 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1900 /prefetch:2
          2⤵
            PID:3796
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,9289003731987975486,15285868386367459897,524288 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2180 /prefetch:3
            2⤵
            • Downloads MZ/PE file
            • System Time Discovery
            PID:1924
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2164,i,14353243767259270026,6425438010626791847,524288 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2448 /prefetch:8
            2⤵
              PID:1776
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,2570582843507935341,3544849665926233160,2097152 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
              2⤵
                PID:4548
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3352,i,156318346285670736,1630829515567412206,2097152 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3372 /prefetch:1
                2⤵
                  PID:1984
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,7440935314085358980,9812199904467526902,2097152 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:2
                  2⤵
                    PID:4232
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,14736816281866473553,4928311140347491186,2097152 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:1
                    2⤵
                      PID:3816
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,2043475353396470916,4599216439537313392,524288 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:8
                      2⤵
                        PID:5096
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5688,i,4566664970845277273,17438974492892813860,2097152 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5544 /prefetch:1
                        2⤵
                          PID:3868
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3340,i,1012945637589150448,6686272487810981409,2097152 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3536 /prefetch:1
                          2⤵
                            PID:1608
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6108,i,12980846843675390515,5516283386055716933,2097152 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6068 /prefetch:1
                            2⤵
                              PID:3568
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3236,i,10012341106965849060,17373040423161824198,2097152 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6248 /prefetch:1
                              2⤵
                                PID:556
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5924,i,6593545861770150956,15905511615158903562,2097152 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:1
                                2⤵
                                  PID:4976
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6376,i,4002594508040047034,7138998569760860794,2097152 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
                                  2⤵
                                    PID:588
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5960,i,2390137949203178787,14005405869881884524,524288 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6256 /prefetch:8
                                    2⤵
                                      PID:5272
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6196,i,7403995527002365842,10260010736413755608,524288 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6188 /prefetch:8
                                      2⤵
                                        PID:5280
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,13107966899629563941,566860776941233017,524288 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3444 /prefetch:8
                                        2⤵
                                          PID:5288
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6572,i,6840931823162087460,7252453505017097235,524288 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6564 /prefetch:8
                                          2⤵
                                            PID:5992
                                          • C:\Users\Admin\Downloads\TLauncher-Installer-1.9.5.1.exe
                                            "C:\Users\Admin\Downloads\TLauncher-Installer-1.9.5.1.exe"
                                            2⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:3056
                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                              "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3969818 "__IRAFN:C:\Users\Admin\Downloads\TLauncher-Installer-1.9.5.1.exe" "__IRCT:3" "__IRTSS:26673860" "__IRSID:S-1-5-21-1074038928-2032447174-945360078-1000"
                                              3⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of SetWindowsHookEx
                                              • Suspicious use of WriteProcessMemory
                                              PID:2392
                                              • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
                                                "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
                                                4⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:5180
                                                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:3839250 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:3869932" "__IRSID:S-1-5-21-1074038928-2032447174-945360078-1000"
                                                  5⤵
                                                  • Downloads MZ/PE file
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of SetWindowsHookEx
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2112
                                                  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5404
                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC15BDE6A\installer.exe
                                                      C:\Users\Admin\AppData\Local\Temp\7zSC15BDE6A\installer.exe --silent --allusers=0 --server-tracking-blob=NjA1ZTNhM2FlNzYyYTU3YTNmZjBmMzE4NmY1YzFlZDlmYzQzODBiOWU1MWMyZDczZGYxNjBkZjY2NzgxODNkOTp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInRpbWVzdGFtcCI6IjE3Nzk2NDAxNDMuMjEwMyIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOC4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFHWCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiMGU5NDhhNmItNTdkYi00NjQ1LWI0YmYtMDFmYzYyOTgyNDA3In0=
                                                      7⤵
                                                      • Downloads MZ/PE file
                                                      • Executes dropped EXE
                                                      • Enumerates connected drives
                                                      • Modifies system certificate store
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1760
                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC15BDE6A\installer.exe
                                                        C:\Users\Admin\AppData\Local\Temp\7zSC15BDE6A\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.84 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff661d99e98,0x7ff661d99ea4,0x7ff661d99eb0
                                                        8⤵
                                                        • Executes dropped EXE
                                                        PID:4272
                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\installer.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\installer.exe" --version
                                                        8⤵
                                                        • Executes dropped EXE
                                                        PID:3932
                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC15BDE6A\installer.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\7zSC15BDE6A\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1760 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_20260524172907" --session-guid=5aeaac3f-93ce-45c9-af52-f0ac98892755 --server-tracking-blob="ZDNlMGNmMTU3ZDhlZmJiY2Q4NzhmZGYwZTNhMWY1NDE4ODVkOTNlNmNmZWY3MzRmOWU3MzZjMzM0NWY3ZGM5Mjp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc3OTY0MDE0My4yMTAzIiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSA4LjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYUdYIiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJNU1RMIn0sInV1aWQiOiIwZTk0OGE2Yi01N2RiLTQ2NDUtYjRiZi0wMWZjNjI5ODI0MDcifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7408000000000000
                                                        8⤵
                                                        • Executes dropped EXE
                                                        • Enumerates connected drives
                                                        • Enumerates system info in registry
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5936
                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC15BDE6A\installer.exe
                                                          C:\Users\Admin\AppData\Local\Temp\7zSC15BDE6A\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.84 --initial-client-data=0x28c,0x290,0x294,0x25c,0x298,0x7ff661d99e98,0x7ff661d99ea4,0x7ff661d99eb0
                                                          9⤵
                                                          • Executes dropped EXE
                                                          PID:5968
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\installer.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\installer.exe" --backend --initial-pid=1760 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071" --session-guid=5aeaac3f-93ce-45c9-af52-f0ac98892755 --server-tracking-blob="ZDNlMGNmMTU3ZDhlZmJiY2Q4NzhmZGYwZTNhMWY1NDE4ODVkOTNlNmNmZWY3MzRmOWU3MzZjMzM0NWY3ZGM5Mjp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc3OTY0MDE0My4yMTAzIiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSA4LjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYUdYIiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJNU1RMIn0sInV1aWQiOiIwZTk0OGE2Yi01N2RiLTQ2NDUtYjRiZi0wMWZjNjI5ODI0MDcifQ== " --silent --desktopshortcut=1 --install-subfolder=131.0.5877.57
                                                          9⤵
                                                          • Executes dropped EXE
                                                          • Enumerates connected drives
                                                          • Enumerates system info in registry
                                                          • Modifies registry class
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SendNotifyMessage
                                                          • Suspicious use of SetWindowsHookEx
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:676
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\installer.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.57 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x7ff6e90a9e98,0x7ff6e90a9ea4,0x7ff6e90a9eb0
                                                            10⤵
                                                            • Executes dropped EXE
                                                            PID:3260
                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071\assistant\assistant_installer.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --copyonly=0 --allusers=0
                                                            10⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Enumerates system info in registry
                                                            • Modifies Internet Explorer settings
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5016
                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071\assistant\assistant_installer.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.36 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0xe71b80,0xe71b8c,0xe71b98
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2108
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --run-assistant --allusers=0
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • Enumerates system info in registry
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2744
                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.36 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x971b80,0x971b8c,0x971b98
                                                                12⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • System Location Discovery: System Language Discovery
                                                                PID:3992
                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe"
                                                                12⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3768
                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                                  13⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Enumerates system info in registry
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4772
                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\opera_crashreporter.exe
                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.57 --initial-client-data=0x1c0,0x1b4,0x1b8,0x180,0x1b0,0x7ffb05ffe610,0x7ffb05ffe620,0x7ffb05ffe630
                                                                    14⤵
                                                                    • Executes dropped EXE
                                                                    PID:2580
                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                                  13⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Enumerates system info in registry
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2892
                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\opera_crashreporter.exe
                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.57 --initial-client-data=0x190,0x194,0x18c,0x15c,0x188,0x7ffb05ffe610,0x7ffb05ffe620,0x7ffb05ffe630
                                                                    14⤵
                                                                    • Executes dropped EXE
                                                                    PID:756
                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.36 --initial-client-data=0x27c,0x280,0x284,0x250,0x288,0xe64370,0xe6437c,0xe64388
                                                                  13⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:6048
                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                                    14⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Enumerates system info in registry
                                                                    PID:652
                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\opera_crashreporter.exe
                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.57 --initial-client-data=0x144,0x148,0x150,0x140,0x14c,0x7ffb05ffe610,0x7ffb05ffe620,0x7ffb05ffe630
                                                                      15⤵
                                                                      • Executes dropped EXE
                                                                      PID:2448
                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                                    14⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Enumerates system info in registry
                                                                    PID:1988
                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\opera_crashreporter.exe
                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.57 --initial-client-data=0x1a0,0x1a4,0x1a8,0x19c,0x1ac,0x7ffb05ffe610,0x7ffb05ffe620,0x7ffb05ffe630
                                                                      15⤵
                                                                      • Executes dropped EXE
                                                                      PID:1616
                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                                    14⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Enumerates system info in registry
                                                                    PID:4564
                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\opera_crashreporter.exe
                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.57 --initial-client-data=0x17c,0x168,0x164,0x180,0x170,0x7ffb05ffe610,0x7ffb05ffe620,0x7ffb05ffe630
                                                                      15⤵
                                                                      • Executes dropped EXE
                                                                      PID:6044
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
                                                            10⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Adds Run key to start application
                                                            • Checks processor information in registry
                                                            • Enumerates system info in registry
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of SendNotifyMessage
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1920
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\opera_crashreporter.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.57 --initial-client-data=0x190,0x194,0x18c,0x15c,0x188,0x7ffb05ffe610,0x7ffb05ffe620,0x7ffb05ffe630
                                                              11⤵
                                                              • Executes dropped EXE
                                                              PID:4852
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,4063920118692938727,7987016357458827675,262144 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1880 /prefetch:2
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:6256
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=2040,i,15909842343592308857,13734643732654663978,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2056 /prefetch:3
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • System Time Discovery
                                                              • Enumerates system info in registry
                                                              PID:6264
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=2332,i,10335227954382611486,1959323180902230588,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2344 /prefetch:8
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:6348
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=2828,i,7596518958236260006,16283064067942519734,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2892 /prefetch:8
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:6620
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3156,i,17912096787668967458,1828300749312451665,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3368 /prefetch:8
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:6632
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3240,i,8626277915055890738,7579900459943719577,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3004 /prefetch:8
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:6628
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3288,i,12772205294262904136,14187918969537666484,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3292 /prefetch:8
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:6668
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3008,i,8422909007596424127,15099459580059263845,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3388 /prefetch:8
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              PID:6676
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3268,i,13006899881382104525,8819134647021263781,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3348 /prefetch:8
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:6696
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 OPR/131.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4056,i,12971633768165292991,15439107827832198876,2097152 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4064 /prefetch:1
                                                              11⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:6728
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\opera_gx_splash.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\opera_gx_splash.exe" --instance-name=61C8973803226C4D4008DEBC18682105EDAB1556896BB924D0EEB1B6C96AB147
                                                              11⤵
                                                              • Executes dropped EXE
                                                              PID:6920
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 OPR/131.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4572,i,1969379598483709765,8539784195889652487,2097152 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4588 /prefetch:1
                                                              11⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:6972
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 OPR/131.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4768,i,17717882416677576220,2364457398732221422,2097152 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4808 /prefetch:2
                                                              11⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:7136
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 OPR/131.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4920,i,12918961532410593326,7661050877737337831,2097152 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4948 /prefetch:1
                                                              11⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:6512
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 OPR/131.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5092,i,16245300073049968997,9692277618830609487,2097152 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=4960 /prefetch:1
                                                              11⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:6492
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --asus-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=4976,i,2015680534846712269,10517736939176190177,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5224 /prefetch:8
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              PID:6496
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --corsair-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=5212,i,7110356550831209124,7496661011583776165,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5332 /prefetch:8
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              PID:6524
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --logitech-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=5208,i,413566442995613730,9607829756153173322,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5336 /prefetch:8
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:6648
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --razer-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=5216,i,17640324611954327213,16576280275827230356,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5344 /prefetch:8
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              PID:6156
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 OPR/131.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5764,i,12907359694711743221,15476078648362065110,2097152 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=5796 /prefetch:2
                                                              11⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:7884
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 OPR/131.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6408,i,1803762425116075758,15876865229842283205,2097152 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6368 /prefetch:2
                                                              11⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:8036
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 OPR/131.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6648,i,6699021430137059364,586672694330384726,2097152 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6692 /prefetch:2
                                                              11⤵
                                                              • Checks computer location settings
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:8092
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 OPR/131.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6348,i,11021053449489173236,3316132849121860812,2097152 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4940 /prefetch:1
                                                              11⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:6824
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=6300,i,10231484801441568694,1928865593390089631,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7160 /prefetch:8
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:7284
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7304,i,2220193171632296953,13631436457289237706,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7320 /prefetch:8
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:6704
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=5376,i,3863548606852990158,4372117682138071675,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=6432 /prefetch:8
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:8088
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7488,i,4648495918036489026,2569887852573739439,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=5708 /prefetch:8
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:8104
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7720,i,1126534943371013036,8999136739595421529,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=7760 /prefetch:8
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:8080
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7708,i,4667017271642523067,13942652709291906402,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7736 /prefetch:8
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              PID:7920
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=8108,i,17035503281488711403,4148075685917311701,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8156 /prefetch:8
                                                              11⤵
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:7560
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=8076,i,17223741320286555431,15999784630025608654,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8136 /prefetch:8
                                                              11⤵
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:7956
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=8060,i,11263498026390877039,13681357112706004258,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8176 /prefetch:8
                                                              11⤵
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:7656
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7932,i,8884316523288257222,364936481195680518,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8200 /prefetch:8
                                                              11⤵
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:7592
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=8120,i,16739777931597520795,1533065256553657266,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=8244 /prefetch:8
                                                              11⤵
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:7340
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=8056,i,17709036668045712522,16914062292962905333,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8220 /prefetch:8
                                                              11⤵
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:8000
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 OPR/131.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=4728,i,17717719802249476334,10630796014382847551,2097152 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9096 /prefetch:2
                                                              11⤵
                                                              • Checks computer location settings
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              PID:8864
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.side_profiles.mojom.SideProfilesHandler --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=9052,i,607425968171799336,7140648309067027957,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=9280 /prefetch:8
                                                              11⤵
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:8944
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=9432,i,3247904913041812266,14939274815131990142,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=9444 /prefetch:8
                                                              11⤵
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:9052
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=9864,i,2877112726157785260,14357406804612714356,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=9876 /prefetch:8
                                                              11⤵
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              PID:7564
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=9616,i,13375298785590219163,2887431019881845924,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10136 /prefetch:8
                                                              11⤵
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:4848
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --pipeid=oauc_pipeF347B60CA73F3F3DA84B31019F4EB851ECFC332513021FC062CC0CA8D8440B54
                                                              11⤵
                                                              • Enumerates system info in registry
                                                              PID:8512
                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.57 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff78acd8eb8,0x7ff78acd8ec4,0x7ff78acd8ed0
                                                                12⤵
                                                                  PID:10156
                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\installer.exe
                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\installer.exe" --fix-taskbar-pins
                                                                11⤵
                                                                • Enumerates system info in registry
                                                                PID:9872
                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\installer.exe
                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.57 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff6e90a9e98,0x7ff6e90a9ea4,0x7ff6e90a9eb0
                                                                  12⤵
                                                                    PID:8848
                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 OPR/131.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=10360,i,9037180508543917904,11505118070949823954,2097152 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10024 /prefetch:1
                                                                  11⤵
                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                  PID:10056
                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-intent=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:domain-suggestions-competitors=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:platform-software-h264-encoder-in-gpu=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=10360,i,9436697659653638703,12981575871990201894,524288 --field-trial-handle=1884,i,4028969458929172763,6036434142573063796,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,PlatformSoftwareH264EncoderInGpu,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1888,i,17322234458223671432,8976446673320013447,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=4572 /prefetch:8
                                                                  11⤵
                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                  • Enumerates system info in registry
                                                                  PID:9152
                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --edition=std-2 --host=https://autoupdate.opera.com/ --installationdatadir="C:\Users\Admin\AppData\Local\Programs\Opera GX" --installdir="C:\Users\Admin\AppData\Local\Programs\Opera GX" --lang=en-US --pipeid --producttype --requesttype=shutdown --version=131.0.5877.57 --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --firstrunver=131.0.5877.57 --firstrunts=1779640211 --consent-info=eyJzdGF0aXN0aWNzX2NvbGxlY3Rpb25fZW5hYmxlZCI6dHJ1ZSwidXNlcl9leHBlcmllbmNlX21ldHJpY3NfcmVwb3J0aW5nX2VuYWJsZWQiOnRydWV9
                                                                  11⤵
                                                                  • Enumerates system info in registry
                                                                  PID:1384
                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.57 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff78acd8eb8,0x7ff78acd8ec4,0x7ff78acd8ed0
                                                                    12⤵
                                                                      PID:8488
                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071\assistant\Opera_GX_assistant_131.0.5877.36_Setup.exe_sfx.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071\assistant\Opera_GX_assistant_131.0.5877.36_Setup.exe_sfx.exe"
                                                              8⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2732
                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071\assistant\assistant_installer.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071\assistant\assistant_installer.exe" --version
                                                              8⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4764
                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071\assistant\assistant_installer.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.36 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0xe71b80,0xe71b8c,0xe71b98
                                                                9⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4712
                                                    • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                                                      "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:6056
                                                      • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                                                        "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
                                                        5⤵
                                                        • Suspicious use of SetWindowsHookEx
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2384
                                                        • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                                                          "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=windows-1252 -jar C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                                                          6⤵
                                                          • Modifies registry class
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1224
                                                          • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\bin\java.exe
                                                            C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\bin\java.exe -Dsun.java2d.uiScale.enabled=false -Xmx1536m -Dfile.encoding=UTF8 -Djava.net.preferIPv4Stack=true --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.desktop/java.awt=ALL-UNNAMED --add-opens=java.desktop/sun.awt.image=ALL-UNNAMED --add-opens=java.desktop/sun.java2d=ALL-UNNAMED --add-opens=java.desktop/java.awt.color=ALL-UNNAMED --add-opens=java.desktop/java.awt.image=ALL-UNNAMED --add-opens=java.desktop/com.apple.eawt=ALL-UNNAMED --add-opens=java.base/java.util.regex=ALL-UNNAMED --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.desktop/java.beans=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.network=ALL-UNNAMED --add-opens=javafx.web/javafx.scene.web=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.event=ALL-UNNAMED -cp C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\annotations-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aopalliance-1.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\arns-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\auth-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-query-protocol-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-xml-protocol-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checker-qual-3.12.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checksums-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checksums-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-compress-1.23.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-io-2.11.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-lang3-3.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-1.1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-api-1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-vfs2-2.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\crt-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\desktop-common-util-1.268.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\DiscordIPC-0.5.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\dnsjava-2.1.8.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\endpoints-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\error_prone_annotations-2.18.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\eventstream-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\failureaccess-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\filters-2.0.235.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\gson-2.13.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guava-31.0.1-jre.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-assistedinject-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-aws-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-aws-eventstream-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-client-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-download-1.268.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpclient5-5.6.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpclient5-fluent-5.6.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpcore5-5.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpcore5-h2-5.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\identity-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\j2objc-annotations-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jackson-annotations-2.13.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jakarta.inject-api-2.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\java-image-scaling-0.8.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javax.annotation-api-1.3.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-api-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-core-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-impl-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jcl-over-slf4j-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-20230227.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-utils-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jsr305-3.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-native-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junrar-0.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\log4j-1.2.17.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-classic-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-core-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\lombok-1.18.30.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-api-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svn-commons-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svnexe-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\metrics-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\MinecraftServerPing-1.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\mockserver-netty-no-dependencies-5.14.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\modpack-dto-2.282.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\picture-bundle-3.73.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\plexus-utils-1.5.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\profiles-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\protocol-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\reactive-streams-1.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regexp-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regions-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\retries-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\retries-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\s3-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\sdk-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\skin-api-1.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\slf4j-api-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\statistics-dto-1.73.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\third-party-jackson-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\tlauncher-resource-1.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\utils-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\utils-lite-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\xz-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\original-TLauncher-2.9365.jar; org.tlauncher.tlauncher.rmo.TLauncher -starterConfig=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\starter.json -requireUpdate=false -currentAppVersion=2.9365 -starterDomainAvailabilityV1=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\domainAvailability.json -country=${country} "-starterJVM=C:\Program Files\Java\jre-1.8\bin\javaw.exe" -starterWorkingDirectory=C:\Users\Admin\Downloads -starterJarFile=C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe -starterFileEncoding=windows-1252 -runVersionWithServer=empty
                                                            7⤵
                                                            • Checks computer location settings
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • System Time Discovery
                                                            • Checks processor information in registry
                                                            • Modifies registry class
                                                            PID:6444
                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                              cmd.exe /C chcp 437 & wmic CPU get NAME
                                                              8⤵
                                                                PID:8616
                                                                • C:\Windows\system32\chcp.com
                                                                  chcp 437
                                                                  9⤵
                                                                    PID:8816
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic CPU get NAME
                                                                    9⤵
                                                                      PID:8908
                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                    cmd.exe /C chcp 437 & set processor
                                                                    8⤵
                                                                      PID:9944
                                                                      • C:\Windows\system32\chcp.com
                                                                        chcp 437
                                                                        9⤵
                                                                          PID:9940
                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                        cmd.exe /C chcp 437 & dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt
                                                                        8⤵
                                                                          PID:6232
                                                                          • C:\Windows\system32\chcp.com
                                                                            chcp 437
                                                                            9⤵
                                                                              PID:9888
                                                                            • C:\Windows\system32\dxdiag.exe
                                                                              dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt
                                                                              9⤵
                                                                                PID:6532
                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                              cmd.exe /C chcp 437 & wmic qfe get HotFixID
                                                                              8⤵
                                                                                PID:6852
                                                                                • C:\Windows\system32\chcp.com
                                                                                  chcp 437
                                                                                  9⤵
                                                                                    PID:9912
                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                    wmic qfe get HotFixID
                                                                                    9⤵
                                                                                      PID:6836
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2440,i,12115053671327993235,7973449095692670340,262144 --field-trial-handle=1904,i,14646489870408949578,12143464753755828966,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3440 /prefetch:8
                                                                        2⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:5436
                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                      1⤵
                                                                        PID:2712
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                        1⤵
                                                                          PID:1648
                                                                        • C:\Windows\System32\GameBarPresenceWriter.exe
                                                                          "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                                                                          1⤵
                                                                          • Network Service Discovery
                                                                          PID:4404
                                                                        • C:\Windows\system32\OpenWith.exe
                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                          1⤵
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:2396
                                                                        • C:\Windows\system32\OpenWith.exe
                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                          1⤵
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:3292
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                                                                          1⤵
                                                                          • Drops desktop.ini file(s)
                                                                          • Checks processor information in registry
                                                                          • Modifies registry class
                                                                          PID:3308
                                                                        • C:\Windows\System32\svchost.exe
                                                                          C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
                                                                          1⤵
                                                                          • Checks processor information in registry
                                                                          • Modifies data under HKEY_USERS
                                                                          PID:5992
                                                                        • C:\Windows\system32\wbem\unsecapp.exe
                                                                          C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                          1⤵
                                                                            PID:6148
                                                                          • C:\Windows\system32\OpenWith.exe
                                                                            C:\Windows\system32\OpenWith.exe -Embedding
                                                                            1⤵
                                                                              PID:6740
                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --autostart
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              PID:7632
                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\opera_crashreporter.exe
                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.57 --initial-client-data=0x170,0x16c,0x168,0x178,0x164,0x7ffb05ffe610,0x7ffb05ffe620,0x7ffb05ffe630
                                                                                2⤵
                                                                                • Executes dropped EXE
                                                                                PID:7532
                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe7FAE56220944838BCDB933E86AD23A432FE91C0ADA84DF94778C72EE141B2B1F
                                                                              1⤵
                                                                              • Enumerates system info in registry
                                                                              PID:9692
                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.57 --initial-client-data=0x274,0x278,0x27c,0x210,0x280,0x7ff78acd8eb8,0x7ff78acd8ec4,0x7ff78acd8ed0
                                                                                2⤵
                                                                                  PID:10020
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                                                                                1⤵
                                                                                • Checks processor information in registry
                                                                                • Modifies registry class
                                                                                PID:9776
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                                                                                1⤵
                                                                                  PID:10216

                                                                                Network

                                                                                      MITRE ATT&CK Enterprise v16

                                                                                      Reconnaissance

                                                                                      Resource Development

                                                                                      Initial Access

                                                                                      Execution

                                                                                      Persistence

                                                                                      Boot or Logon Autostart Execution

                                                                                      1
                                                                                      T1547

                                                                                      Registry Run Keys / Startup Folder

                                                                                      1
                                                                                      T1547.001

                                                                                      Event Triggered Execution

                                                                                      1
                                                                                      T1546

                                                                                      Component Object Model Hijacking

                                                                                      1
                                                                                      T1546.015

                                                                                      Privilege Escalation

                                                                                      Boot or Logon Autostart Execution

                                                                                      1
                                                                                      T1547

                                                                                      Registry Run Keys / Startup Folder

                                                                                      1
                                                                                      T1547.001

                                                                                      Event Triggered Execution

                                                                                      1
                                                                                      T1546

                                                                                      Component Object Model Hijacking

                                                                                      1
                                                                                      T1546.015

                                                                                      Defense Evasion

                                                                                      Modify Registry

                                                                                      3
                                                                                      T1112

                                                                                      Subvert Trust Controls

                                                                                      1
                                                                                      T1553

                                                                                      Install Root Certificate

                                                                                      1
                                                                                      T1553.004

                                                                                      Credential Access

                                                                                      Credentials from Password Stores

                                                                                      1
                                                                                      T1555

                                                                                      Credentials from Web Browsers

                                                                                      1
                                                                                      T1555.003

                                                                                      Unsecured Credentials

                                                                                      1
                                                                                      T1552

                                                                                      Credentials In Files

                                                                                      1
                                                                                      T1552.001

                                                                                      Discovery

                                                                                      Browser Information Discovery

                                                                                      1
                                                                                      T1217

                                                                                      Network Service Discovery

                                                                                      1
                                                                                      T1046

                                                                                      Peripheral Device Discovery

                                                                                      2
                                                                                      T1120

                                                                                      Query Registry

                                                                                      7
                                                                                      T1012

                                                                                      System Information Discovery

                                                                                      6
                                                                                      T1082

                                                                                      System Location Discovery

                                                                                      1
                                                                                      T1614

                                                                                      System Language Discovery

                                                                                      1
                                                                                      T1614.001

                                                                                      System Network Configuration Discovery

                                                                                      1
                                                                                      T1016

                                                                                      Internet Connection Discovery

                                                                                      1
                                                                                      T1016.001

                                                                                      System Time Discovery

                                                                                      1
                                                                                      T1124

                                                                                      Lateral Movement

                                                                                      Collection

                                                                                      Data from Local System

                                                                                      1
                                                                                      T1005

                                                                                      Command and Control

                                                                                      Exfiltration

                                                                                      Impact

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      3903daac9bc4a3b7.timestamp
                                                                                      • Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
                                                                                      • Size 46B
                                                                                      • SHA256 491f61be34d06a7cb4bfc969b688a19893c47a83da3ef1fd2b6a1a3416aa8272
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                      • Size 471B
                                                                                      • SHA256 e3c776c80e807f607f2cdfd264da70ef6c34a1c14aeee176433bfe15b82afb5c
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                      • Size 416B
                                                                                      • SHA256 130d7537ad27c768317f86377c2ee6ccade2f53b3717c29165483c0f7d1b84fc
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      BookmarkMergedSurfaceOrdering
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                      • Size 6B
                                                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      BrowsingTopicsState
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                      • Size 649B
                                                                                      • SHA256 ac4624c5f7ab52d40ef51f8cdb5ef70324b5c5b874e938acb1fc95f4715a3650
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      the-real-index
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                      • Size 1KB
                                                                                      • SHA256 45078454b9d43fb648d21284a53fb60bd9cf32fb3cae37b30637c7034e183ba2
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      Network Persistent State
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                      • Size 8KB
                                                                                      • SHA256 515d165f60baa231f82b5d1d37d0147ed5abd5c7090ef4981f6e7799b78944a1
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      SCT Auditing Pending Reports
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                      • Size 2B
                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      TransportSecurity
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                      • Size 1022B
                                                                                      • SHA256 d2f92f8d5fd231bd6d511693e33df945a5c89c6df0d2d67d35d430e3b01ab2b8
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      Preferences
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                      • Size 13KB
                                                                                      • SHA256 69f547a3a5d2b7109d862975104822e52cf13fc1c98c540cf3564953e5042dba
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Preferences
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                      • Size 13KB
                                                                                      • SHA256 8acbc13b8c47fc935786053a1b9a56b83b4ef75538fc1e206697ab4cdbc2c989
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Preferences
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                      • Size 14KB
                                                                                      • SHA256 a50883b7e9456209faa012388681f0525c92230310c3a34c72e0829d6ac8edab
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Preferences
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                      • Size 12KB
                                                                                      • SHA256 020cf7be11c3f4152df8fbb01dfeeb1a634b62b34ed8293aa8b2ff897ea0aa46
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Secure Preferences
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                      • Size 17KB
                                                                                      • SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      the-real-index
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                      • Size 120B
                                                                                      • SHA256 82f2c8c24d7272994f2f867072533a16b9b43b08d8a6a3d4acfb28c41af14bd1
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      the-real-index~RFe59837e.TMP
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59837e.TMP
                                                                                      • Size 96B
                                                                                      • SHA256 714d252ebf21a5af79e4d2c2b969f73c8686b28edf271c3cb50577fd51017e00
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      the-real-index
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                      • Size 72B
                                                                                      • SHA256 f015159c541a63b9cfda0aadc4292ead2d2e349968b3dc33c17ba65efad63eee
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      Local State
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                      • Size 231KB
                                                                                      • SHA256 94ed10cd34640aead2dc90ecdd05c4080c7d26d11a52aa2564b741537999689f
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Local State
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                      • Size 231KB
                                                                                      • SHA256 ab9bfcac30ad44ac473fe7ee0e44d0f44c0eecaca9115513c6656e1a10ffea3f
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Local State
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                      • Size 115KB
                                                                                      • SHA256 80eeac5b7bf7ad6ffcf797cfb2cd823e120b7947d8c76a877c9f470d342e429a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Local State
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                      • Size 232KB
                                                                                      • SHA256 e1c719872beb0eac9b56232e18ac6a55cee0669b43e9ae5d88a933e321bb3e5a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Local State
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                      • Size 307KB
                                                                                      • SHA256 4debff111a9a650f4800d28e11901a65bc2951b1464294281f199c9ccf1d3683
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      data_0
                                                                                      • Path C:\Users\Admin\AppData\Local\Opera Software\Opera GX Stable\Default\System Cache\Cache_Data\data_0
                                                                                      • Size 44KB
                                                                                      • SHA256 a054fdd81e499220ec09bf377464dbf991210fd03dc878c582a8aaa7db4f959b
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      data_1
                                                                                      • Path C:\Users\Admin\AppData\Local\Opera Software\Opera GX Stable\Default\System Cache\Cache_Data\data_1
                                                                                      • Size 264KB
                                                                                      • SHA256 8e3ae2c40d6f9117a36ea6f427d63b03a983ded4618aa62728c081037576eb64
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      data_2
                                                                                      • Path C:\Users\Admin\AppData\Local\Opera Software\Opera GX Stable\Default\System Cache\Cache_Data\data_2
                                                                                      • Size 8KB
                                                                                      • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      data_3
                                                                                      • Path C:\Users\Admin\AppData\Local\Opera Software\Opera GX Stable\Default\System Cache\Cache_Data\data_3
                                                                                      • Size 8KB
                                                                                      • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      installer.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\installer.exe
                                                                                      • Size 9.1MB
                                                                                      • SHA256 574bfe860ff9106ac64702670adbffcc411a35ed998a640e2334adfe2bb164e3
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      custom_partner_content.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\131.0.5877.57\resources\custom_partner_content.json
                                                                                      • Size 245KB
                                                                                      • SHA256 84bc1efb211c6b45f2906278a36f1414922f994a9611bbee7713ffd4ae21e967
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      opera.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                      • Size 2.6MB
                                                                                      • SHA256 0357e9d40fa1cd89fe6036d1503bfd4dbcf4b7d5c8e521c951126529a991fba9
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      +JXF10479472162600476279.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\+JXF10479472162600476279.tmp
                                                                                      • Size 477KB
                                                                                      • SHA256 a4ece920f221b78d43b550d615c5934db162b64a331ffa663a85199e74ef2e6b
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      +JXF13583108976898003501.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\+JXF13583108976898003501.tmp
                                                                                      • Size 141KB
                                                                                      • SHA256 b2efabca5ea4bc56eea829713706b5cd0788b82aca153bd4adde9b1573933b4f
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      +JXF14301384296604522745.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\+JXF14301384296604522745.tmp
                                                                                      • Size 191KB
                                                                                      • SHA256 9384b96c3c71d777fe20da8ffec067a4a50802f1ef42a1f3543d2b8059a45add
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      +JXF14501772682082751886.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\+JXF14501772682082751886.tmp
                                                                                      • Size 156KB
                                                                                      • SHA256 7149f8f1d8b0386ab74427c78d660e211c572ffd901897f86475319d28248083
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      +JXF3133311154884915413.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\+JXF3133311154884915413.tmp
                                                                                      • Size 132KB
                                                                                      • SHA256 9287925cae90ac480804094ff0876832065e2db116470da1f524d79ed9c18b70
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      +JXF877876100622875944.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\+JXF877876100622875944.tmp
                                                                                      • Size 424KB
                                                                                      • SHA256 83ff53f599acefc11f5cf63fd0516d4db72aacf7f0125a5f79c9ff222cbf9dd7
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Opera GX Browser.lnk
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071\Opera GX Browser.lnk
                                                                                      • Size 1KB
                                                                                      • SHA256 f64fb5f360e7eb7f606b3d39edac6969113a064909ebceec4b0d09b23d7a391a
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      additional_file0.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071\additional_file0.tmp
                                                                                      • Size 2.8MB
                                                                                      • SHA256 aea99ad410a597e74390c1a4c41fd8b9a0847c555e62538f20690bc4f5081073
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      assistant_installer.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071\assistant\assistant_installer.exe
                                                                                      • Size 2.4MB
                                                                                      • SHA256 e47c83fe3e201c5d2e39f068a59b75dc4c640bb2d77e330b00f2f7de47c5a264
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      dbgcore.dll
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071\assistant\dbgcore.dll
                                                                                      • Size 196KB
                                                                                      • SHA256 4a2e6daaac3c2f30d5d50ff17d758c7872149d852eba4fc8249682da49cba611
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      dbghelp.dll
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071\assistant\dbghelp.dll
                                                                                      • Size 1.8MB
                                                                                      • SHA256 4ffe74dd53a715011655419a9fb741a0699b4fe722768cee8267016fa931140a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      installer_prefs_include.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071\installer_prefs_include.json
                                                                                      • Size 242B
                                                                                      • SHA256 40ea1fbf69784552a6aca6f03f95b7ec4c38332d39c88322835c70b661d643dd
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      installer_prefs_include.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071\installer_prefs_include.json
                                                                                      • Size 910B
                                                                                      • SHA256 4d9a34aa5910e53a6708e3187268a78a7e47dd9237544bea3d44cd6456985c70
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      installer_prefs_include.json.backup
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\90a2f10b-81f8-4f8a-80e7-08781d4b8a38 Opera GX Installer Temp\opera_package_202605241729071\installer_prefs_include.json.backup
                                                                                      • Size 227B
                                                                                      • SHA256 97331f17409895395d817dd6dab7119ff107665a9f866a3c2926bfa9ada6b1b7
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      installer.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zSC15BDE6A\installer.exe
                                                                                      • Size 9.1MB
                                                                                      • SHA256 69bdbb8a932cde8ec4c47501dad116e0b01870f512685acda4a19c758ff29750
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      200.ico
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
                                                                                      • Size 116KB
                                                                                      • SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      BrowserInstaller.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe
                                                                                      • Size 3.7MB
                                                                                      • SHA256 e20f18d8c5d3621a81d35fe43d759ddb148e35d1856a94fbe95dfbec93127a10
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      IRIMG1.BMP
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP
                                                                                      • Size 12KB
                                                                                      • SHA256 1d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      IRIMG14.PNG
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG14.PNG
                                                                                      • Size 43KB
                                                                                      • SHA256 6528bb11becf79c17c77a9c6624b82074b9dd6d3e932852c8fe1da22a57854aa
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      IRIMG15.PNG
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG15.PNG
                                                                                      • Size 644B
                                                                                      • SHA256 207bd7ad2eb7f48a2a1be1253363fa120ae79e25eacbd37d6b9be52d2128bfdd
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      IRIMG17.PNG
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG17.PNG
                                                                                      • Size 40KB
                                                                                      • SHA256 06fad383e3506eb1be52877bee839b833de157a2601af1c443ef1244a92f5d8f
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      IRIMG2.BMP
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP
                                                                                      • Size 12KB
                                                                                      • SHA256 9c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      IRIMG3.BMP
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP
                                                                                      • Size 12KB
                                                                                      • SHA256 4c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      IRIMG9.PNG
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG9.PNG
                                                                                      • Size 438B
                                                                                      • SHA256 d16a8eaf8f979e45bacbbd8ef14afe482d74e926dff2e87e569342874ba34145
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      IRZip.lmd
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
                                                                                      • Size 400KB
                                                                                      • SHA256 3a6794c90d69383bd76098992cb512ae343cb2e1a3680dd4794e49895472b429
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Wow64.lmd
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
                                                                                      • Size 252KB
                                                                                      • SHA256 27b48727237cd0f8a1205e01e5c93cbe6c7a2f3938faf8d8daa5191094c347a5
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      irsetup.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                                                                      • Size 1.8MB
                                                                                      • SHA256 96070b2d82b6bffd54719f9753909be5f5151edbd5b37b26f50dea2e995ea430
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      lua5.3.dll
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
                                                                                      • Size 395KB
                                                                                      • SHA256 eef58c3dae331da03872b973230aa56b40e34035035cca5b468eda0c40daa819
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      irsetup.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                                                                      • Size 1.7MB
                                                                                      • SHA256 ea04ee2883ca5dcb461ea894a4e2def7d0c89f11d9f06f3bae020f6a25e7b75d
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      lua5.3.dll
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.3.dll
                                                                                      • Size 395KB
                                                                                      • SHA256 0e43d22649d6b2ecbac9915dc6498fe1f41777dd33147d962b30dad0d5e76ab3
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      opera-installer-bro.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                                                                      • Size 3.9MB
                                                                                      • SHA256 6e200d42c49f15ec1822f4e5ea41bca3fc04aed551f54ca7dd44340082029805
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      setuparguments.ini
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
                                                                                      • Size 801B
                                                                                      • SHA256 5b8d935c58ef5010f855113f53399294b8d993a95f4555e1f7202ad71a1dff6b
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      TLauncher.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                                                                                      • Size 9.2MB
                                                                                      • SHA256 8cdc16a8f34f99dc85273838350ae9a9a840de8c6dda3c045c5514520842dd78
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      IRIMG1.PNG
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.PNG
                                                                                      • Size 45KB
                                                                                      • SHA256 a42ab4d62c5a5286202df15f9ad32b22396d5d12c7a4db8c5a2c98f90160ade1
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      IRIMG10.PNG
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG10.PNG
                                                                                      • Size 206B
                                                                                      • SHA256 348e3f3544cca4c9ca2af323fa8b3453a70ea421c82b331681dc1d4ef74921f3
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      IRIMG13.PNG
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG13.PNG
                                                                                      • Size 41KB
                                                                                      • SHA256 1708790d5496b9cc325cc0249cfa272aac3c3738188fc41eef83e8592de247ff
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      IRIMG3.PNG
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG3.PNG
                                                                                      • Size 475B
                                                                                      • SHA256 d339d7a5fcaff72292150f3c7db87a73caa396e23224b570e053c8bb96a3a897
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      IRIMG4.BMP
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.BMP
                                                                                      • Size 451KB
                                                                                      • SHA256 64da5bd044908b2c3a725c5a55edec1644be498f41ea05d42a6ae8cd797f1d80
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      IRIMG4.PNG
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG
                                                                                      • Size 368B
                                                                                      • SHA256 3207283d0abc0dd36c0991b40a738247394bbc92e5696eb790a5c888a9f28106
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      uninstall.xml
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                                                                      • Size 3KB
                                                                                      • SHA256 a14aabf96798ec24f6e314d95e24906a4838ec2c6a7ca2aa57f3b52083a19529
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      uninstall.xml
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                                                                      • Size 7KB
                                                                                      • SHA256 2cb610314f0e99c3e217a2246871b41643a5afce449b26f419aeb59ec074b1f0
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      uninstall.xml
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                                                                      • Size 21KB
                                                                                      • SHA256 eed3258624c1cfc43994af48a68cfb84aba8ba6c31efc499bcccf182184329ca
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      version_manifest.json
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_launchermeta.mojang.com\mc\game\version_manifest.json
                                                                                      • Size 197KB
                                                                                      • SHA256 85cc9f4a6eea30aeabf6bcd8afa423f9634bf4e35db08f2e655ca6dbf7925a67
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      inner_servers-1.2.json
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tlauncher.org\update\downloads\configs\inner_servers-1.2.json
                                                                                      • Size 7KB
                                                                                      • SHA256 d238c2e774983057ad5e205c73ba333ea93c663f39548aa68a2798712feae19a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      index_en.html
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tlauncher.org\update\downloads\configs_v1\pages\index_en.html
                                                                                      • Size 45KB
                                                                                      • SHA256 8a5894c0780ff94f3ef3ba3fe57cebf04d967bd8ffc9253ca5fd0427fad48301
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      libraries-1.7.json
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tlauncher.org\update\downloads\libraries\org\tlauncher\authlib\libraries-1.7.json
                                                                                      • Size 365KB
                                                                                      • SHA256 d4ce6740244db00a95ca1b1c1120ead62ce73026ad8b55cce15a5a0903dc28fe
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      additional_assets-1.1.json
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tlauncher.org\update\downloads\versions\new5\additional_assets-1.1.json
                                                                                      • Size 190KB
                                                                                      • SHA256 12ea0578ab812f6e6730ea5b23e7f8bfcbaec59e801b8699abc1e773a3b7476b
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      version_manifest.json
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tlauncher.org\update\downloads\versions\new5\skin\versions\version_manifest.json
                                                                                      • Size 12KB
                                                                                      • SHA256 e5a04128c61d6c23b527b4914f3cacb711a6691d2eab89813f7f2f5a9d34069f
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      version_manifest.json
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tlauncher.org\update\downloads\versions\new5\version_manifest.json
                                                                                      • Size 48KB
                                                                                      • SHA256 5f718a755d458d7c2a3eb1632b97c0fd28b08e32fb818ce02373840ea819421a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      additional_hot_servers-1.0.json
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tlauncher.org\update\lch\additional_hot_servers-1.0.json
                                                                                      • Size 33KB
                                                                                      • SHA256 65b6d7d8cd32d547fbd4fb21d917a516236637832d732d9e084ba015ef1ba292
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      hot_servers-1.0.json
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tlauncher.org\update\lch\servers\hot_servers-1.0.json
                                                                                      • Size 58KB
                                                                                      • SHA256 f11cc606c44e05158cdbacfa2ab5a6aefe45eb119734b30bc796ad3cf8485f13
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      dependencies.json
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9365\dependencies.json
                                                                                      • Size 25KB
                                                                                      • SHA256 f3b6338044c30bc0bfa1a27c9065c95be3a1676312dcd5c970afc8b3ab365cc0
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      resources.json
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9365\resources.json
                                                                                      • Size 17KB
                                                                                      • SHA256 b34c2e5606e2479ea49fcdcfd933305b87c53b9c31ccacc4a1e90fb6f7a01f5a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      appConfig.json
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\appConfig.json
                                                                                      • Size 4KB
                                                                                      • SHA256 d9695c4c9dcdee7f476c69dafa094a93aded88a6cad2c06415f8372be125b94a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      javaConfig21.json
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\javaConfig21.json
                                                                                      • Size 3KB
                                                                                      • SHA256 4e677c3608065a9a12f97bededc27fd440711f94288012207645df37f516d699
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      starter-core-1.268-v3.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\update\lch\starter-core-1.268-v3.exe
                                                                                      • Size 9.2MB
                                                                                      • SHA256 a92a1dea42081672b52a60748064d443f4366f98e04a189fd3b56b24816f26d6
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      COPYRIGHT
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\java.logging\COPYRIGHT
                                                                                      • Size 35B
                                                                                      • SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      LICENSE
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\java.logging\LICENSE
                                                                                      • Size 33B
                                                                                      • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      ADDITIONAL_LICENSE_INFO
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\javafx.web\ADDITIONAL_LICENSE_INFO
                                                                                      • Size 51B
                                                                                      • SHA256 0a256a7133bd2146482018ba6204a4ecc75836c139c8792da53536a9b67071d4
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ASSEMBLY_EXCEPTION
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\javafx.web\ASSEMBLY_EXCEPTION
                                                                                      • Size 46B
                                                                                      • SHA256 a4b7ad48df36316ddd7d47fcecc1d7a2c59cbfe22728930220ef63517fd58cb0
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      LICENSE
                                                                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\javafx.web\LICENSE
                                                                                      • Size 35B
                                                                                      • SHA256 01a4ebd2a3b2671d913582f1241a176a13e9be98f4e3d5f2f04813e122b88105
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      settings.dat
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
                                                                                      • Size 40B
                                                                                      • SHA256 f695b702a418cbe3e5741e20be1cde3c28f0cf6cb73b6531adbab21fcd9de27f
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      6cd87fe9-6948-4bae-9edb-2a8afbcc8121.tmp
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\6cd87fe9-6948-4bae-9edb-2a8afbcc8121.tmp
                                                                                      • Size 162KB
                                                                                      • SHA256 5903c920e584fc5f1e918bd641bf58fd56e8cb20bb68269892a4984ea7538621
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      7ccf5fa7-e176-421f-b559-f6f77c6a4c9b.tmp
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\7ccf5fa7-e176-421f-b559-f6f77c6a4c9b.tmp
                                                                                      • Size 15KB
                                                                                      • SHA256 07e9c0bcf780e1782482e435d3e22092838b385214026bef2cd2ccfaa8d8a9c4
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      the-real-index
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
                                                                                      • Size 312B
                                                                                      • SHA256 abe0296d8da76921571cfa345da1fe62a942228d87c4253fc810c3a4ef7910e8
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      the-real-index~RFe5b6b88.TMP
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index~RFe5b6b88.TMP
                                                                                      • Size 48B
                                                                                      • SHA256 0937cadf2c1bd5ffc71ab0f6f5efd4de0d1f4e414fc243a64150b185906c25e2
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      CURRENT
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extension Rules\CURRENT
                                                                                      • Size 16B
                                                                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      MANIFEST-000001
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extension Scripts\MANIFEST-000001
                                                                                      • Size 41B
                                                                                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      the-real-index
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                      • Size 120B
                                                                                      • SHA256 970f6b329efbadbb2e37e7f7ba6a6c5cc43f0b2a29cba51c3b5399c03eb27dd4
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      the-real-index~RFe5b68d8.TMP
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b68d8.TMP
                                                                                      • Size 72B
                                                                                      • SHA256 41beb510301f6f89342664302ae344bdc7d93f78c4e11e32b05495726ff9b8ac
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 3KB
                                                                                      • SHA256 52e4063d9b6ad2d6b59bd145d8c2812bebe3192ba8dfd34f8206db913f4090df
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 8KB
                                                                                      • SHA256 242055970db75cfa5c50367ff15c876f0e474575f22d1756e2be37326b00a9d2
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 10KB
                                                                                      • SHA256 e631d556d6dae35ef9db06236c1ab526a5b4c32c0f007fb707770056ab2dae88
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 11KB
                                                                                      • SHA256 23babe4ee4a6d2254267fff45a3f9ca245f1014d3204c73232d512b70fc2853a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 493B
                                                                                      • SHA256 4ff9a93a6f898b116ec7bbfc753098551a7625f2bebe201fca81aa6353c32a17
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 605B
                                                                                      • SHA256 31b62f5f477fa6a8862b57f11dfafaeb2e956c3467dd812701ef0acc9b20704a
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 2KB
                                                                                      • SHA256 e7a141d31ff6c9f186c38ebf9febc837e355f7817c67e44c20b371f698f96f50
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 2KB
                                                                                      • SHA256 2a3fd527c24396ba8cdda40ac525efea188183042607014c21964737a37e0d89
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 2KB
                                                                                      • SHA256 c71571222f18ad44914da37340dc404e9628657983ddcc61caac93594de66a60
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 3KB
                                                                                      • SHA256 06153f53a6e969a656b5c616f504c90d87539a0497b88dc06fbc52e858ac28ac
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 8KB
                                                                                      • SHA256 c36494ca308e7041333b2ea1438c4b81435629c2a97f5d4ae69ea26edcfa512c
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 8KB
                                                                                      • SHA256 a56bf1a9fc94ced63cc9d0d1c5e4ea94683d6aeefb2d9a5a1671fb85cc0c875a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 5c7f4e1cd4e5f1b247b1a872f07f3195c05e08f2ae86fbe734e06f435fb12bc7
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 1e483f14b4440065251f55be8fdd9cf06b2f75f6bf8b1a25b6ad4a59924e0da7
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 bdcdae678d1e26d6835dcb56423d4ef01f8a3c7405bca953cbb03cc291e993d2
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 03db41abaea9358f11603d8d8e976741579c20892e077e4fe8ef11c100170535
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 7b22a44101c7640757b94f9c1d8e1095b308b4c1f6e9fabcafa765730057fd4d
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 fe1bd7adb2bdacbccb19b7ab938a81e44346e77ea0db5561a1770317d6744b89
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 b0e55579c3e6511d3f5fad0efa54c2a1091f0b8999a1fd43441604e9f8486363
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 8ffbb40b84695dc23c83f5bc5a110a27b19f2148d4acd623d74708402271d2a7
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 fd86d33d2a0b8dd51b91c0247ae216d5d7ab9de07fc30f2478f885b73f751936
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 cc5fda8c45a11158195079e6afeb57f59e96849a982db856cf678b1c8c4421b7
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 260a25f23f601f2624e13d15f6c7652b9ac1a1cb038cfd4f919c7cbbd6dc4f89
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 a080d4f4da03b54072b0530f51f2436626ba74b4438de70665fc3f239c74658d
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 d80ca6c2faf4850828a45ab156aea3c05cb702faad92e47db5e5329232201184
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 573e9193c710d2a347f87d82ae63e2b4f975b64fb442295fcc62a80ab723679f
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 dc9559454a5914004c8d57b929b89ff5551235e0ce2d2580493f75791375e0a9
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 735bf9761062980a7b52be0557d66a3ba1bff775df83eb1134f60f796a2978e2
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 3e091ff4899830010c0ffc4f7a02b15e63d6222034b7c6e1c397125744dcd809
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 10KB
                                                                                      • SHA256 555772e056d5d4720ff2c9fe2943db38bfbec83427faec136ee264bd5bda519e
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 11KB
                                                                                      • SHA256 7c63dff0ccd0eb86f78399ed9525db2d65862847427c3931f30b71937dd3131d
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 11KB
                                                                                      • SHA256 26e997220a159b847b0f9fcad27419ce49131999c70e1654650b51afb07da4cb
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 733B
                                                                                      • SHA256 c99a952bd70310afb804680dc8fc008f1e7eb7a0fbec787791303d212effb5f0
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 909B
                                                                                      • SHA256 2c6efc2a0fb5ec1c777e596335007e2988d9fe5a19f414a8c8ca1bdfba6ce293
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 1KB
                                                                                      • SHA256 22b33ef363075e12a95679a1eff5588ca94b9405869b8e7e8e2a185b7c67ea7f
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 1KB
                                                                                      • SHA256 d9ba9037e33ade483eb14f6677c7d9306c78473e08fa65b79d318e3f17dddabb
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 1KB
                                                                                      • SHA256 40af55293aa0ec946b01d166b0b1e910fcdb3bc124522fac95332dcfe3d4e382
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 1KB
                                                                                      • SHA256 471ee0fb13b79c0dbc6cd190ad2b30582fc2b29c48c9ee054436b42922e3f569
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 1KB
                                                                                      • SHA256 8aed2259c95ad513cc38f3dc272fb9549d956d8926682cc51483831b98c5c633
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 1KB
                                                                                      • SHA256 4d2e83f65fc8e093d8d71d88bdf2730cec597a8016c993b2468053dc30716abd
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 1KB
                                                                                      • SHA256 2580cb2163fba4cde5eea385efb893aa2f8adbfbacd2aa74a1a9379d7664e63f
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 1KB
                                                                                      • SHA256 e48267f3e372f550e1a320ce27896fb53b00f41218fc6360c0d7d90f4bb22148
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 2KB
                                                                                      • SHA256 c1804ccf790cafac940bd6b3ca0937f68a8ebfca04f9df4981b5ee68f8c99a41
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 2KB
                                                                                      • SHA256 d13711dd1e5c76930047c88d0918792a7d6a3899fd6bbe3d5703d115d2ebec97
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 2KB
                                                                                      • SHA256 2dd5cf30a71717810994f752f72c5e41f1dc97fe9532f1500490446102f1086f
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 2KB
                                                                                      • SHA256 99edb5f70be1481f0b0942f1a99baba9519412b6a1c0411384ebf523a3bcaaf6
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 2KB
                                                                                      • SHA256 0cd5c7bfc1a4ca2c9f1be1c7f201338d1c6428cfabbf6ec49938ce100894ab71
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 2KB
                                                                                      • SHA256 ddf4758ae28cbbef2c0353ff8d7cbe5f0d84b15afa9adc3c11c889606213f164
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 4af00881ad73675adacaaafaa306c983dc90bedfd70a0dbaf48a992ffb589a92
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 066f41b03efb9e62a2406f8a17540e6b29ce3f2de22a5420947044691643f92a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 4bab5aa7db4cbfdad99e49af8139f5db553a873b98589ba743cf5a0e7efe2537
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 9KB
                                                                                      • SHA256 86b88197d88dbf6be0ae3066e843915ab95489fbd555a4e38f38a71cab8b7545
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 1KB
                                                                                      • SHA256 fdb27d0f044221f4d315ca591d16e9d2186dfa21d63f2de93d32a519b0d15968
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 2KB
                                                                                      • SHA256 384b77d32d7e4542b79229ead7affd8741af76e9226222612971bcb8dca990c6
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 10KB
                                                                                      • SHA256 559b05ba7da92721a448711ec778c5d703be485e61484d0dfc509187f80d81bb
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 10KB
                                                                                      • SHA256 255e8c2c799566e1e83558f4c26bb88e13e583f041d9c5e3f25210f88654ed2a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw
                                                                                      • Size 10KB
                                                                                      • SHA256 a2b72038126630fb6c8598fe82238756fc7286243ab3b2395408a77884ff71a1
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw~RFe5b4b00.TMP
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_bca9ec08-b3eb-4838-8200-dca57ec04770.raw~RFe5b4b00.TMP
                                                                                      • Size 381B
                                                                                      • SHA256 cda1856b2991506bea2ab19a124d96aa178b6e0520884f3455491042700bbaa9
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ad3b9de4-2f8a-4359-a314-934383cd58fc.tmp
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ad3b9de4-2f8a-4359-a314-934383cd58fc.tmp
                                                                                      • Size 24KB
                                                                                      • SHA256 9f1749ba5847c7a7aa21af42d31b682c13f6f35f6f6a50e545eebdced18ff502
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.0.1788689847
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.0.1788689847
                                                                                      • Size 418B
                                                                                      • SHA256 e8647dc2bc19c605abf51f58bc06de8eccc407ce378a8b7500edf029b2615092
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.0.1788689847
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.0.1788689847
                                                                                      • Size 578B
                                                                                      • SHA256 c340d06f49e300a9cff0a243705b0111037cd8f966acaf5296efb090b981a31e
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.0.1788689847
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.0.1788689847
                                                                                      • Size 2KB
                                                                                      • SHA256 1fff27725b86fbb0eabf6e4862ea5036ca0a24b4b96e383a9d803428f473059b
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.0.1788689847
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.0.1788689847
                                                                                      • Size 1KB
                                                                                      • SHA256 24e4bc6b25f393a70fd7c64ee2b62e5ec952a1dcf91ace3ece7f3424d1fa6e64
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.0.1788689847
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.0.1788689847
                                                                                      • Size 2KB
                                                                                      • SHA256 35e1920dd2be845e44379d1ce3dca1dac1358134e132d464dd59f39e1ea59640
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.0.1788689847
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.0.1788689847
                                                                                      • Size 2KB
                                                                                      • SHA256 c7943a83de09e6d43ef2df254d68c557cae28752b5115716787cc1c840e81da1
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.0.1788689847
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.0.1788689847
                                                                                      • Size 2KB
                                                                                      • SHA256 e78cf58789a5b683d47f30f5631aa95ad26a4f8f5a57144b82f1115a6313cd35
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.0.1788689847
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.0.1788689847
                                                                                      • Size 2KB
                                                                                      • SHA256 47aed1fa2c890158e682d906940b4660b9c3f9fe6d41a6dc7d1e8f6600f53165
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.0.1788689847
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.0.1788689847
                                                                                      • Size 2KB
                                                                                      • SHA256 e7caf79856681c56b33adeaed7175d49d22bf2aea407b319d9db592e1970ebbf
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.0.1788689847
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.0.1788689847
                                                                                      • Size 2KB
                                                                                      • SHA256 7131d2713d9505fbf0512210ffb991c5bae7250a3aa6d8179424084f0089e938
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.0.1788689847
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.0.1788689847
                                                                                      • Size 3KB
                                                                                      • SHA256 d94088e168660d2b205f8534f29d430a758416bb6dbd27dc8c9bbb6930287974
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.0.1788689847
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.0.1788689847
                                                                                      • Size 516B
                                                                                      • SHA256 0888be060647bc70b6a8a138c0ddfb86a504297a4e7ce0f04f68669ecd922fa4
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.0.1788689847~RFe5b5a32.TMP
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.0.1788689847~RFe5b5a32.TMP
                                                                                      • Size 357B
                                                                                      • SHA256 0f1bde635fc1a94284cfe1e0292021a948a858eb21fa9a9f6b50243939c44bfa
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 296B
                                                                                      • SHA256 4c031b138cf83ce7d26a24701229d4bb284389b59a7e9dc00c660723f3e6b5cb
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 1KB
                                                                                      • SHA256 c66954482a57f49c0d524d34cea2cb805676d66d0625fffa367f9cd60b58b40a
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 389B
                                                                                      • SHA256 302e92f259343d328df9ec91c450b80afec35fd72df2d3b6c3f0bae27fc61c5c
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 481B
                                                                                      • SHA256 4571b965e9f1543428e274137e5a1b017e76bc38d12b0348ba1ebdc6c57e1fe1
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 574B
                                                                                      • SHA256 422ee6d39ae163d99ab24acc11ea50f9048ce0d46071c138dcdde0357bab09ac
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 663B
                                                                                      • SHA256 f834c14c5bcebf441e531be1cd8716577707d0398dee56396ad06222f4d7f0a9
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 756B
                                                                                      • SHA256 bde891643f3c2996d7e0b365777db4ffef17dc03a56657eb923f7b6d293c727b
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 857B
                                                                                      • SHA256 4043f389832245d64b5bd5047013cd00b931d72fea0c16ddfbb3da240d0727b3
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 949B
                                                                                      • SHA256 51054e04445fd8c0d6e0efb67a8c3d09ffedc91a237081db9b194bdc475bf4a1
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 1KB
                                                                                      • SHA256 80a2b3ad7fc41ea95de026d894be5d52acf3e86c71347b78e2df83cfc63e99ae
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 1KB
                                                                                      • SHA256 2c761c0274c84c633d10f214c13a638d951532a6cb580717502c5e9d341f0d74
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 1KB
                                                                                      • SHA256 86afc41909269efc45d5e426a0a35e3be0b41438a477965fbd4fb99ddf4e3dfc
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 2KB
                                                                                      • SHA256 93e901f46373c786616d5b53b22e3f3c135ebfe362ebae17be1bed606eee6789
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 3KB
                                                                                      • SHA256 9283b5d198f4f492aa9b49106ddf57576004562a60bafdd7de36a5e9d5b9c0fe
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 3KB
                                                                                      • SHA256 d308d0b0e9ebdb3fbc5cab50177c7d30cb72cf44bc26fc7445e4ec151af7b937
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 3KB
                                                                                      • SHA256 25ded5a42a5e6f20df73f4e1de23ca6859271dbbc7d694e1bbdc881c1ed814f7
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 3KB
                                                                                      • SHA256 4079fba36c3fc49cfbd21874d3b89ced40df516e02eca72c0ead91c82b69035c
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 3KB
                                                                                      • SHA256 8011cd968787433c010e1c7d37c88e5f7867f8521b6d1da08aba83a369f16501
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 3KB
                                                                                      • SHA256 58d867c6c8487f449cc875f5bba9bd68dd55007274f4c031ffb9dac27efdd1fc
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 3KB
                                                                                      • SHA256 4d067dd815ff2e5c21a2cd1125c7e8ec4e83a205150da231e6bc094e3a3ebcd6
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 1KB
                                                                                      • SHA256 e65f2288152625615918866f99552f9ab20d7b7e551577245233e34688ecf7ce
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 1KB
                                                                                      • SHA256 e9952ce65d0a0f084a616b7a8541491d0817f1c6189754d2d15c1a126292f475
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 1KB
                                                                                      • SHA256 54f12f15225ab8a8a7009403a2c4ce3c58715e30dc09e50419c9b23d6e5159ab
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 1KB
                                                                                      • SHA256 a2472e4bad69a83449328bb071e402fb23667bfd981094b380074acd2b004c5d
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568
                                                                                      • Size 3KB
                                                                                      • SHA256 3fb671036153621e809fc9bbd076b9e9065a4d12a309bee0b23638c42f5728bd
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.1.1078859568~RFe5b5bc8.TMP
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.1.1078859568~RFe5b5bc8.TMP
                                                                                      • Size 171B
                                                                                      • SHA256 f77a69a880ee9bd251b5edc005c537ec9f25bd51a0a89abd43f6140cf246f767
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.2.1886259677
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.2.1886259677
                                                                                      • Size 217B
                                                                                      • SHA256 0e312ce74336bd7acca4c963db560d277a2be741681785fffc683722da0e28e2
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      ssdfp1920.2.1886259677~RFe5b68d8.TMP
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1920.2.1886259677~RFe5b68d8.TMP
                                                                                      • Size 173B
                                                                                      • SHA256 e25352a76b50f3c364a8c71e5fbdfd518bc0a783546f7fea21da0edc62b5d923
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      Local State
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Local State
                                                                                      • Size 3KB
                                                                                      • SHA256 5c6e041a1e47a839a8441ce6b3538bae33333cfdd1a697c0cd56533310e4f959
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      Local State~RFe5b68e8.TMP
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Local State~RFe5b68e8.TMP
                                                                                      • Size 3KB
                                                                                      • SHA256 eb715ea8d0d9441abba15fbdb1d45e56cdf6923692d77d40ec1f6f9764d80ee9
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      assistant_prefs.json
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\assistant_prefs.json
                                                                                      • Size 151B
                                                                                      • SHA256 d63240ad80687fd5026ecabeb7abe7ddaf9d3c04641969cbd4d6909f2cb8e952
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      assistant_prefs.json~RFe5bb051.TMP
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\assistant_prefs.json~RFe5bb051.TMP
                                                                                      • Size 151B
                                                                                      • SHA256 50d4b2eb7fb099ad95d09b35368c9255be669998c7337155c0dbaa88453c2223
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      7801f893-aca5-47b5-afcb-58d3d8703bc2.tmp
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\component_crx_cache\7801f893-aca5-47b5-afcb-58d3d8703bc2.tmp
                                                                                      • Size 13B
                                                                                      • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      Unconfirmed 850501.crdownload
                                                                                      • Path C:\Users\Admin\Downloads\Unconfirmed 850501.crdownload
                                                                                      • Size 25.5MB
                                                                                      • SHA256 0619bd07d3183a8ae0cb1be408c6ad32295d47ddd666b2d51edd4d5f5d211227
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      desktop.ini
                                                                                      • Path C:\Users\Admin\Videos\Captures\desktop.ini
                                                                                      • Size 190B
                                                                                      • SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      memory/1224-2653-0x00000141E6CC0000-0x00000141E6CC1000-memory.dmp
                                                                                      Download

                                                                                      memory/1224-2621-0x00000141E6CC0000-0x00000141E6CC1000-memory.dmp
                                                                                      Download

                                                                                      memory/1224-2642-0x00000141E6CC0000-0x00000141E6CC1000-memory.dmp
                                                                                      Download

                                                                                      memory/1224-2407-0x00000141E6CC0000-0x00000141E6CC1000-memory.dmp
                                                                                      Download

                                                                                      memory/1224-2472-0x00000141E6CC0000-0x00000141E6CC1000-memory.dmp
                                                                                      Download

                                                                                      memory/1224-2585-0x00000141E6CC0000-0x00000141E6CC1000-memory.dmp
                                                                                      Download

                                                                                      memory/1224-2659-0x00000141E6CC0000-0x00000141E6CC1000-memory.dmp
                                                                                      Download

                                                                                      memory/1224-2589-0x00000141E6CC0000-0x00000141E6CC1000-memory.dmp
                                                                                      Download

                                                                                      memory/1224-2636-0x00000141E6CC0000-0x00000141E6CC1000-memory.dmp
                                                                                      Download

                                                                                      memory/1224-2594-0x00000141E6CC0000-0x00000141E6CC1000-memory.dmp
                                                                                      Download

                                                                                      memory/1224-2612-0x00000141E6CC0000-0x00000141E6CC1000-memory.dmp
                                                                                      Download

                                                                                      memory/1224-2635-0x00000141E6CC0000-0x00000141E6CC1000-memory.dmp
                                                                                      Download

                                                                                      memory/1224-2604-0x00000141E6CC0000-0x00000141E6CC1000-memory.dmp
                                                                                      Download

                                                                                      memory/1224-2568-0x00000141E6CC0000-0x00000141E6CC1000-memory.dmp
                                                                                      Download

                                                                                      memory/1224-2582-0x00000141E6CC0000-0x00000141E6CC1000-memory.dmp
                                                                                      Download

                                                                                      memory/1224-2600-0x00000141E6CC0000-0x00000141E6CC1000-memory.dmp
                                                                                      Download

                                                                                      memory/1224-2651-0x00000141E6CC0000-0x00000141E6CC1000-memory.dmp
                                                                                      Download

                                                                                      memory/2112-1842-0x0000000000C30000-0x0000000001227000-memory.dmp
                                                                                      Download

                                                                                      memory/2112-1064-0x0000000000C30000-0x0000000001227000-memory.dmp
                                                                                      Download

                                                                                      memory/2112-4630-0x0000000000C30000-0x0000000001227000-memory.dmp
                                                                                      Download

                                                                                      memory/2112-967-0x0000000000C30000-0x0000000001227000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2047-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2113-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2112-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2095-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2231-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2288-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2204-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2040-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2102-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2326-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2097-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2321-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-1991-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2154-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2228-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2295-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2056-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2105-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2090-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2088-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2218-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2084-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-1888-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2093-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2298-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2223-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2152-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-2092-0x0000016BC9810000-0x0000016BC9811000-memory.dmp
                                                                                      Download

                                                                                      memory/2392-1889-0x0000000000180000-0x0000000000781000-memory.dmp
                                                                                      Download

                                                                                      memory/2392-1074-0x0000000000180000-0x0000000000781000-memory.dmp
                                                                                      Download

                                                                                      memory/2392-1063-0x0000000000180000-0x0000000000781000-memory.dmp
                                                                                      Download

                                                                                      memory/2392-1026-0x0000000000180000-0x0000000000781000-memory.dmp
                                                                                      Download

                                                                                      memory/2392-1841-0x0000000000180000-0x0000000000781000-memory.dmp
                                                                                      Download

                                                                                      memory/2392-937-0x0000000000180000-0x0000000000781000-memory.dmp
                                                                                      Download

                                                                                      memory/2392-355-0x0000000000180000-0x0000000000781000-memory.dmp
                                                                                      Download

                                                                                      memory/4060-16-0x00007FF7F24DA000-0x00007FF7F2A24000-memory.dmp
                                                                                      Download

                                                                                      memory/4060-8-0x00007FFB43AD0000-0x00007FFB43AD2000-memory.dmp
                                                                                      Download

                                                                                      memory/4060-24-0x00007FF7F2430000-0x00007FF7F300B000-memory.dmp
                                                                                      Download

                                                                                      memory/4060-23-0x00007FF7F24DA000-0x00007FF7F2A24000-memory.dmp
                                                                                      Download

                                                                                      memory/4060-22-0x000002BBE1570000-0x000002BBE15C5000-memory.dmp
                                                                                      Download

                                                                                      memory/4060-17-0x00007FF7F2430000-0x00007FF7F300B000-memory.dmp
                                                                                      Download

                                                                                      memory/4060-3-0x00007FFB46240000-0x00007FFB46242000-memory.dmp
                                                                                      Download

                                                                                      memory/4060-15-0x000002BBE1570000-0x000002BBE15C5000-memory.dmp
                                                                                      Download

                                                                                      memory/4060-7-0x00007FFB45790000-0x00007FFB45792000-memory.dmp
                                                                                      Download

                                                                                      memory/4060-0-0x00007FF7F24DA000-0x00007FF7F2A24000-memory.dmp
                                                                                      Download

                                                                                      memory/4060-6-0x00007FFB45780000-0x00007FFB45782000-memory.dmp
                                                                                      Download

                                                                                      memory/4060-9-0x00007FFB43AE0000-0x00007FFB43AE2000-memory.dmp
                                                                                      Download

                                                                                      memory/4060-11-0x00007FF7F2430000-0x00007FF7F300B000-memory.dmp
                                                                                      Download

                                                                                      memory/4060-4-0x00007FFB46250000-0x00007FFB46252000-memory.dmp
                                                                                      Download

                                                                                      memory/4060-5-0x00007FFB46260000-0x00007FFB46262000-memory.dmp
                                                                                      Download

                                                                                      memory/4060-1-0x00007FF7F2430000-0x00007FF7F300B000-memory.dmp
                                                                                      Download

                                                                                      memory/4060-2-0x00007FFB46230000-0x00007FFB46232000-memory.dmp
                                                                                      Download

                                                                                      memory/6056-1877-0x0000000000400000-0x0000000000420000-memory.dmp
                                                                                      Download