9dcf20d5c2079ad8ed0365e81ca51a366fe842c7271efb6f43d810187ef48cbe

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
899s
max time network
903s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
camera_btn.png
Size 785B
Sample260730-ssmmfa1bla
SHA256 9dcf20d5c2079ad8ed0365e81ca51a366fe842c7271efb6f43d810187ef48cbe
MD5 8f876c37964e4b42eab6f4e24cee5c41
SHA1 d773332d562b5b3a5226535113a94e117decb3e0
SHA512 06caf897336b385d160418090b6353e226322da91056b56a4fa044be7e163eb14fea40478e86ca55098fec327253dd5a6b6246980694133c5e52e6f3dabe69dc
TLSH
T1430120E38A249ED9B04A6C9C776705E1E058D1BC2FB08235B07E6810C9AF6243A64B1E
MD5 SHA1 SHA512 TLSH

Score

8^/10

adware defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 5 IoCs

flow	pid	Process
594	5328	chrome.exe
626	6612	Madium Executor_42526205.exe
650	4800	installer.exe
650	4800	installer.exe
624	6612	Madium Executor_42526205.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 64 IoCs

pid	Process
6612	Madium Executor_42526205.exe
3704	GameBooster.exe
4412	GameBooster.exe
812	GameBooster.exe
7152	OperaGX_42526205.exe
4800	installer.exe
6212	installer.exe
3768	installer.exe
2988	installer.exe
1872	installer.exe
4252	Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe
7356	assistant_installer.exe
7392	assistant_installer.exe
7852	installer.exe
7912	installer.exe
2340	assistant_installer.exe
7360	assistant_installer.exe
7536	assistant_installer.exe
7520	assistant_installer.exe
7904	browser_assistant.exe
8140	opera.exe
7844	opera.exe
7312	opera_crashreporter.exe
8436	opera.exe
8428	opera.exe
8732	opera.exe
8724	opera.exe
8740	opera.exe
8752	opera.exe
8772	opera.exe
8780	opera.exe
8792	opera.exe
8764	opera.exe
8596	opera_gx_splash.exe
8644	opera.exe
8684	opera_crashreporter.exe
4052	opera_crashreporter.exe
3984	opera.exe
3260	opera_crashreporter.exe
8340	browser_assistant.exe
7372	opera.exe
8876	opera_crashreporter.exe
8812	opera.exe
3336	opera_crashreporter.exe
8692	opera.exe
8716	opera_crashreporter.exe
9632	opera.exe
9644	opera.exe
9672	opera.exe
9696	opera.exe
9708	opera.exe
9716	opera.exe
9724	opera.exe
9732	opera.exe
9840	opera.exe
9892	opera.exe
10560	opera.exe
10828	opera.exe
9312	opera_autoupdate.exe
10664	opera.exe
10460	opera.exe
9504	opera.exe
2528	opera.exe
11188	opera_autoupdate.exe

Loads dropped DLL 64 IoCs

pid	Process
4412	GameBooster.exe
7356	assistant_installer.exe
7356	assistant_installer.exe
7392	assistant_installer.exe
7392	assistant_installer.exe
2340	assistant_installer.exe
2340	assistant_installer.exe
7360	assistant_installer.exe
7360	assistant_installer.exe
7536	assistant_installer.exe
7536	assistant_installer.exe
7520	assistant_installer.exe
7520	assistant_installer.exe
7904	browser_assistant.exe
7904	browser_assistant.exe
8140	opera.exe
7844	opera.exe
7844	opera.exe
8428	opera.exe
8740	opera.exe
8428	opera.exe
8752	opera.exe
8752	opera.exe
8436	opera.exe
8732	opera.exe
8436	opera.exe
8792	opera.exe
8792	opera.exe
8724	opera.exe
8724	opera.exe
8732	opera.exe
8772	opera.exe
8740	opera.exe
8772	opera.exe
8764	opera.exe
8780	opera.exe
8764	opera.exe
8780	opera.exe
8428	opera.exe
8428	opera.exe
8428	opera.exe
8428	opera.exe
8644	opera.exe
8644	opera.exe
8428	opera.exe
8140	opera.exe
3984	opera.exe
3984	opera.exe
8340	browser_assistant.exe
8340	browser_assistant.exe
7372	opera.exe
7372	opera.exe
8812	opera.exe
8812	opera.exe
8692	opera.exe
8692	opera.exe
9632	opera.exe
9632	opera.exe
9644	opera.exe
9644	opera.exe
9732	opera.exe
9724	opera.exe
9732	opera.exe
9724	opera.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Opera GX Browser Assistant = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera GX\\assistant\\browser_assistant.exe"	assistant_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Opera GX Stable = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera GX\\opera.exe\" --autostart"	opera.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
679	raw.githubusercontent.com
683	raw.githubusercontent.com
254	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 6 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Booster\GameBooster.exe	Madium Executor_42526205.exe
File created	C:\Program Files\Booster\hgsdk.dll	Madium Executor_42526205.exe
File created	C:\Program Files\Booster\GameBooster.exe	GameBooster.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7324	cmd.exe
8804	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGX_42526205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	browser_assistant.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	browser_assistant.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
8436	opera.exe
5328	chrome.exe

Checks SCSI registry key(s) 3 TTPs 17 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	opera.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	browser_assistant.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera_autoupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera_autoupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera_autoupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
8656	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\browser_assistant.exe = "9000"	assistant_installer.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\hgsdk\CurrentVersion	GameBooster.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\hgsdk\CurrentVersion\B7F0E3FA-E812-4CE3-A5EA-174B209C1C22 = "024810340f4b42ac9cc8a83458a57644"	GameBooster.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\hgsdk\CurrentVersion\B1B23168-E827-4FBF-B58D-47ECF602EFD6 = "1"	GameBooster.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\hgsdk\CurrentVersion	GameBooster.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298986384142331"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	GameBooster.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\hgsdk	GameBooster.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Applications	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{8C63D4B8-CF89-4527-B10F-99914B6C207F}\LocalServer32	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{8C63D4B8-CF89-4527-B10F-99914B6C207F}	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Opera GXStable\shell\open\ddeexec\Topic	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.html\OpenWithProgIDs\Opera GXStable = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Opera GXStable\shell\open\ddeexec\Application	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.opdownload\OpenWithProgIDs\Opera GXStable = "0"	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.htm\OpenWithProgIDs\Opera GXStable = "0"	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.shtml\OpenWithProgIDs\Opera GXStable = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.xht\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.pdf\OpenWithProgIDs	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.xht\OpenWithProgIDs\Opera GXStable = "0"	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Opera GXStable\shell\open\ddeexec\Topic\	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.opdownload\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.html\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.pdf	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Opera GXStable\shell\open\command	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.gxanimations\OpenWithProgIDs	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.gxanimations\OpenWithProgIDs\Opera GXStable = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.xht	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Applications\opera.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera GX\\opera.exe\" \"%1\""	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\OperaStable	Madium Executor_42526205.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaStable	Madium Executor_42526205.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Opera GXStable\shell\open\ddeexec	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.xhtml\OpenWithProgIDs\Opera GXStable = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Applications\opera.exe	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{8C63D4B8-CF89-4527-B10F-99914B6C207F}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera GX\\133.0.5932.81\\notification_helper.exe\""	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{8C63D4B8-CF89-4527-B10F-99914B6C207F}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera GX\\133.0.5932.81\\notification_helper.exe"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Opera GXStable	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Opera GXStable\URL Protocol	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Opera GXStable\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera GX\\opera.exe\" -noautoupdate -- \"%1\""	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Opera GXStable\shell\open\ddeexec\	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.xhtml	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.htm	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.html	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.pdf\OpenWithProgIDs\Opera GXStable = "0"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Opera GXStable\shell	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.opdownload	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Opera GXStable\FriendlyTypeName = "Opera GX Web Document"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.shtml	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Applications\opera.exe\shell	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\OperaGXStable	Madium Executor_42526205.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Opera GXStable\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera GX\\opera.exe,0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Opera GXStable\shell\open	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Applications\opera.exe\shell\open	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Opera GXStable\DefaultIcon	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.shtml\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Applications\opera.exe\shell\open\command	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Opera GXStable\shell\open\ddeexec\Application\	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.htm\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.xhtml\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{A33BD6A8-76B2-46E3-8000-50A1E402D5DA}	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaGXStable	Madium Executor_42526205.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	Madium Executor_42526205.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.gxanimations	installer.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1436	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4660	mspaint.exe
4660	mspaint.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1368	chrome.exe
1368	chrome.exe
7848	Madium-Installer.exe
7848	Madium-Installer.exe
7844	opera.exe
7844	opera.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
812	GameBooster.exe
10480	taskmgr.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
812	GameBooster.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
7904	browser_assistant.exe
7904	browser_assistant.exe
7844	opera.exe
7844	opera.exe
7844	opera.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
1972	chrome.exe
812	GameBooster.exe
7904	browser_assistant.exe
7904	browser_assistant.exe
7844	opera.exe
7844	opera.exe
7844	opera.exe
7844	opera.exe
7844	opera.exe
7844	opera.exe
7844	opera.exe
7844	opera.exe
7844	opera.exe
7844	opera.exe
7844	opera.exe
7844	opera.exe
7844	opera.exe
7844	opera.exe
7844	opera.exe
7844	opera.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe
10480	taskmgr.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4660	mspaint.exe
4660	mspaint.exe
4660	mspaint.exe
4660	mspaint.exe
10480	taskmgr.exe
10480	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 4820	1972	chrome.exe	94
PID 1972 wrote to memory of 4496	1972	chrome.exe	95
PID 1972 wrote to memory of 4496	1972	chrome.exe	95
PID 1972 wrote to memory of 5328	1972	chrome.exe	96
PID 1972 wrote to memory of 4308	1972	chrome.exe	98
PID 1972 wrote to memory of 4308	1972	chrome.exe	98
PID 1972 wrote to memory of 828	1972	chrome.exe	99
PID 1972 wrote to memory of 828	1972	chrome.exe	99
PID 1972 wrote to memory of 4260	1972	chrome.exe	100
PID 1972 wrote to memory of 4260	1972	chrome.exe	100
PID 1972 wrote to memory of 1768	1972	chrome.exe	101
PID 1972 wrote to memory of 1768	1972	chrome.exe	101
PID 1972 wrote to memory of 5988	1972	chrome.exe	102
PID 1972 wrote to memory of 5988	1972	chrome.exe	102
PID 1972 wrote to memory of 5312	1972	chrome.exe	103
PID 1972 wrote to memory of 5312	1972	chrome.exe	103
PID 1972 wrote to memory of 5252	1972	chrome.exe	104
PID 1972 wrote to memory of 5252	1972	chrome.exe	104
PID 1972 wrote to memory of 3760	1972	chrome.exe	105
PID 1972 wrote to memory of 1216	1972	chrome.exe	106
PID 1972 wrote to memory of 1216	1972	chrome.exe	106
PID 1972 wrote to memory of 4920	1972	chrome.exe	107
PID 1972 wrote to memory of 4920	1972	chrome.exe	107
PID 1972 wrote to memory of 1904	1972	chrome.exe	112
PID 1972 wrote to memory of 4852	1972	chrome.exe	111
PID 1972 wrote to memory of 1904	1972	chrome.exe	112
PID 1972 wrote to memory of 4852	1972	chrome.exe	111
PID 1972 wrote to memory of 1084	1972	chrome.exe	113
PID 1972 wrote to memory of 1084	1972	chrome.exe	113
PID 1972 wrote to memory of 5512	1972	chrome.exe	114
PID 1972 wrote to memory of 5512	1972	chrome.exe	114
PID 1972 wrote to memory of 6064	1972	chrome.exe	115
PID 1972 wrote to memory of 6064	1972	chrome.exe	115
PID 1972 wrote to memory of 5900	1972	chrome.exe	116
PID 1972 wrote to memory of 3836	1972	chrome.exe	117
PID 1972 wrote to memory of 5900	1972	chrome.exe	116
PID 1972 wrote to memory of 3764	1972	chrome.exe	118
PID 1972 wrote to memory of 3836	1972	chrome.exe	117
PID 1972 wrote to memory of 3764	1972	chrome.exe	118
PID 1972 wrote to memory of 1628	1972	chrome.exe	119
PID 1972 wrote to memory of 1628	1972	chrome.exe	119
PID 1972 wrote to memory of 1952	1972	chrome.exe	120
PID 1972 wrote to memory of 2676	1972	chrome.exe	121
PID 1972 wrote to memory of 2396	1972	chrome.exe	122
PID 1972 wrote to memory of 1952	1972	chrome.exe	120
PID 1972 wrote to memory of 2676	1972	chrome.exe	121
PID 1972 wrote to memory of 2396	1972	chrome.exe	122
PID 1972 wrote to memory of 5796	1972	chrome.exe	123
PID 1972 wrote to memory of 5796	1972	chrome.exe	123
PID 1972 wrote to memory of 3476	1972	chrome.exe	124
PID 1972 wrote to memory of 3476	1972	chrome.exe	124
PID 1972 wrote to memory of 6064	1972	chrome.exe	126
PID 1972 wrote to memory of 2692	1972	chrome.exe	127
PID 1972 wrote to memory of 3348	1972	chrome.exe	128
PID 1972 wrote to memory of 2484	1972	chrome.exe	129
PID 1972 wrote to memory of 2484	1972	chrome.exe	129
PID 1972 wrote to memory of 4440	1972	chrome.exe	130
PID 1972 wrote to memory of 4440	1972	chrome.exe	130
PID 1972 wrote to memory of 2732	1972	chrome.exe	131
PID 1972 wrote to memory of 2732	1972	chrome.exe	131
PID 1972 wrote to memory of 680	1972	chrome.exe	132
PID 1972 wrote to memory of 680	1972	chrome.exe	132
PID 1972 wrote to memory of 4520	1972	chrome.exe	133
PID 1972 wrote to memory of 4520	1972	chrome.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\camera_btn.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa4,0x134,0x7ffab529c728,0x7ffab529c734,0x7ffab529c740
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,5916435311344923621,18238497515440802717,262144 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=1816 /prefetch:2
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,12951400216075190456,1486106581082590368,524288 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,1289091429673153293,14103092524738113076,524288 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,15688889622692170744,5422367283548218859,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,3121729604844356233,13057136830546653501,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4716,i,6921340201759851735,16070423860460362764,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4892,i,340171187178602763,11453192005521631885,524288 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4876,i,5552982606800330608,5403127891958280223,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4868,i,4849558347090470550,111539432853686706,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,8560557581116723694,3924832190807941937,524288 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5332,i,11901509735776274648,583760184662572023,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5372,i,9886057305541466634,16616294335250949030,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5648,i,2790876696631644990,2928848779152128967,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,11497119153320351293,4925173777891957643,524288 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5364,i,16210956989858308915,13309686854176971906,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5368,i,6152253363309709474,18390461520243695630,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,1105605475833449118,3451036329002219398,524288 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:6064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6056,i,179885289198177393,11638252462728154261,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,18115660371814255505,9368985344859433221,524288 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5736,i,2845992135175020507,12906139203909309109,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5548,i,1558261374237799277,15645603237058871935,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6040,i,3862236534670030647,11958629019911321586,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5992,i,10835175132183592487,16821938119337332237,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:9
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5444,i,2485946896561346765,17902607545599664454,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5588,i,12257302432702719247,2652257200823701019,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3332,i,16383729377245163528,7843249168740692261,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,9103883498397974422,10351036519949903498,524288 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:6064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,590040326618718522,13503969470059270179,524288 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,11757673256442025120,5338655512773393194,524288 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6036,i,3025128865001344600,934259800392818719,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5024,i,2384042060159484892,14789440782547659786,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6364,i,1200989970392972285,10560704857093701375,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6456,i,11219506122808568400,14763173104028704170,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=908,i,9508207501668886556,14907120087127269772,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=5628,i,17589803657136210627,11810930151960538590,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,6171248822684430313,8419141295565064301,524288 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  - Modifies registry class
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5024,i,17634256225449373939,10245351252585179390,524288 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:12
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6028,i,1111945533894432749,7329264679821490742,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6212,i,15798856747479830941,6762644099467547430,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6424,i,14272212597481610033,5474112071011247030,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6696,i,8602506855992307703,14211686783036754596,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=6760,i,4455906560569953136,1176333288776717214,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7116,i,1615439971308349310,1031567471022201199,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=7216,i,15696445611278829722,12474681193805419947,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=7364,i,2487997447055020335,7428108597615400715,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7016,i,12073004421356878326,9479202534618463295,262144 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7016,i,5738448628046851372,18135273032563365717,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=6700,i,14854851462481957828,964856753122353154,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=7172,i,760831843786644114,17453174982018206573,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=6764,i,2797654585940009693,18237590848580799653,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=7784,i,16185310128265654600,11133859135799227552,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=7188,i,11744566322044217793,7863181508610950739,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=7472,i,12070721539177097728,2157868254636675741,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=6864,i,12426271394072409502,3901015720196640771,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=7564,i,18242566050105942574,17255366918493666543,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=6824,i,14098540463805171896,15350709632519297894,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=8272 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=8212,i,8465146452461945712,6653595076975363813,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=8428 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=8476,i,5850198807588240236,8922637418465129194,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=8488 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=8684,i,5165544594560865147,4124571455169952121,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=8620 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=8664,i,12512416036742974599,3774970983408808300,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=8812 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=9016,i,6676060274491863753,7213878935789573284,524288 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=9004 /prefetch:14
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=9516,i,247651284467523962,6785265659703696522,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=9484 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=9496,i,13779314129214614503,5829341031323079299,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=9476 /prefetch:1
  2⤵
  PID:6704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=9480,i,16171797789938237826,3651688730330848877,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=9344 /prefetch:1
  2⤵
  PID:6772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=9564,i,496671042011203494,7634226389714725388,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=9348 /prefetch:1
  2⤵
  PID:6840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=9352,i,3168537733521394347,6007473017480216922,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=9664 /prefetch:1
  2⤵
  PID:6976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=3324,i,10328009013583243769,2122482103878557003,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=9420 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=9736,i,14185926896578904564,11862556790199149604,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=9748 /prefetch:1
  2⤵
  PID:6152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=9508,i,4105983144811920942,10217773901476841942,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=9324 /prefetch:1
  2⤵
  PID:6180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=9712,i,10342625276526213438,14673019954782975516,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:6232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=9572,i,17330219391381618782,3519277295868024696,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=9436 /prefetch:1
  2⤵
  PID:6488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=6908,i,2072049088093248074,13984543380600417990,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=9204 /prefetch:1
  2⤵
  PID:6740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=9508,i,957631717850785056,15280544826581697677,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=9776 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --metrics-shmem-handle=9548,i,8838396018089621226,3513771071530674181,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=9476 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --metrics-shmem-handle=9400,i,7664278902929427422,16514626445688369487,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=9308 /prefetch:1
  2⤵
  PID:6156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=6492,i,4149093595386562670,7696884139940209782,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=9448 /prefetch:1
  2⤵
  PID:6300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --metrics-shmem-handle=9160,i,12835773506584834771,2466115680304850666,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=9700 /prefetch:1
  2⤵
  PID:6644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --metrics-shmem-handle=10024,i,13742262141180450801,14512301440758220815,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=9952 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --metrics-shmem-handle=10092,i,4432707826525189890,14649904444322807493,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=10048 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --metrics-shmem-handle=10200,i,3438330416360572783,15889124772731038391,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=10232 /prefetch:1
  2⤵
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --metrics-shmem-handle=10396,i,8288651770219553600,18354363926650759605,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=10420 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=10972,i,602110931078102714,12022166128764082520,524288 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=10928 /prefetch:14
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --metrics-shmem-handle=10992,i,29571004851289342,2479810510258518684,2097152 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:6936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=10396,i,7962844280563751930,9154403784780393953,524288 --field-trial-handle=1820,i,8169633976761440819,3319652549561307042,262144 --variations-seed-version --mojo-platform-channel-handle=11092 /prefetch:14
  2⤵
  PID:3812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6912

C:\Users\Admin\Downloads\Madium Executor_42526205.exe
"C:\Users\Admin\Downloads\Madium Executor_42526205.exe"
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
PID:6612
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1436
- C:\Program Files\Booster\GameBooster.exe
  "C:\Program Files\Booster\GameBooster.exe" install
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3704
- C:\Users\Admin\AppData\Local\OperaGX_42526205.exe
  C:\Users\Admin\AppData\Local\OperaGX_42526205.exe --silent --allusers=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7152
- - C:\Users\Admin\AppData\Local\Temp\7zS0FBC3EBD\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS0FBC3EBD\installer.exe --silent --allusers=0 --server-tracking-blob=NTk0Y2NkNDYyNTkzMDI4NzY3OGY2MGUwOTZmZTA1NjU4NmM1MTNjNTIzZWYzNGFiNGRhZTE4YzVlMWExZDdjOTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCNV85NDE2XzM1NzUmdXRtX2lkPTQzYWYzNjM5MmU2ZjQyNGQ5N2ExZmEyZDBkMjA2YTE0IiwidGltZXN0YW1wIjoiMTc4NTQyNTMxNi45MzUwIiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fVVNfUEI1Xzk0MTZfMzU3NSIsImlkIjoiNDNhZjM2MzkyZTZmNDI0ZDk3YTFmYTJkMGQyMDZhMTQiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJhMTM1NGQxOC0yMGM0LTQ3NjItOWIwYy1jOGJhMWM5NWQyOWQifQ==
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\7zS0FBC3EBD\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS0FBC3EBD\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.109 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x7ff7761acd88,0x7ff7761acd94,0x7ff7761acda0
      4⤵
      Executes dropped EXE
      PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\7zS0FBC3EBD\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS0FBC3EBD\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=4800 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\opera_package_20260730112847" --session-guid=cb971e3a-090f-4424-a872-2805c0423fce --server-tracking-blob=MjhlYjMyNDZlYjRlYWIzZmU5YThmOGQzNjg0MTAyOGU0MmUyZWQ3ODVkNDBjYjc5OWI2MGRlNTQ3ODBjZTkyYzp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCNV85NDE2XzM1NzUmdXRtX2lkPTQzYWYzNjM5MmU2ZjQyNGQ5N2ExZmEyZDBkMjA2YTE0Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg1NDI1MzE2LjkzNTAiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA3LjA7IFdpbmRvd3MgTlQgNi4yOyBXaW42NDsgeDY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9VU19QQjVfOTQxNl8zNTc1IiwiaWQiOiI0M2FmMzYzOTJlNmY0MjRkOTdhMWZhMmQwZDIwNmExNCIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImExMzU0ZDE4LTIwYzQtNDc2Mi05YjBjLWM4YmExYzk1ZDI5ZCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=EC07000000000000
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\7zS0FBC3EBD\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0FBC3EBD\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.109 --initial-client-data=0x2a8,0x2ac,0x2bc,0x28c,0x2c0,0x7ff7761acd88,0x7ff7761acd94,0x7ff7761acda0
        5⤵
        Executes dropped EXE
        
        PID:1872
    - - C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\installer.exe" --backend --initial-pid=4800 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\opera_package_202607301128471" --session-guid=cb971e3a-090f-4424-a872-2805c0423fce --server-tracking-blob=MjhlYjMyNDZlYjRlYWIzZmU5YThmOGQzNjg0MTAyOGU0MmUyZWQ3ODVkNDBjYjc5OWI2MGRlNTQ3ODBjZTkyYzp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCNV85NDE2XzM1NzUmdXRtX2lkPTQzYWYzNjM5MmU2ZjQyNGQ5N2ExZmEyZDBkMjA2YTE0Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg1NDI1MzE2LjkzNTAiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA3LjA7IFdpbmRvd3MgTlQgNi4yOyBXaW42NDsgeDY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9VU19QQjVfOTQxNl8zNTc1IiwiaWQiOiI0M2FmMzYzOTJlNmY0MjRkOTdhMWZhMmQwZDIwNmExNCIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImExMzU0ZDE4LTIwYzQtNDc2Mi05YjBjLWM4YmExYzk1ZDI5ZCJ9 --silent --desktopshortcut=1 --install-subfolder=133.0.5932.81
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Enumerates system info in registry
        Modifies registry class
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.81 --initial-client-data=0x2a8,0x2ac,0x2b0,0x288,0x2b4,0x7ff6a45ccd88,0x7ff6a45ccd94,0x7ff6a45ccda0
        6⤵
        Executes dropped EXE
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\opera_package_202607301128471\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\opera_package_202607301128471\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --copyonly=0 --allusers=0
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        Modifies Internet Explorer settings
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\opera_package_202607301128471\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\opera_package_202607301128471\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.28 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0xd14b80,0xd14b8c,0xd14b98
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --run-assistant --allusers=0
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.28 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x5d4b80,0x5d4b8c,0x5d4b98
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\opera_crashreporter.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.81 --initial-client-data=0x174,0x178,0x17c,0x170,0x180,0x7ffa90561560,0x7ffa90561570,0x7ffa90561580
        10⤵
        Executes dropped EXE
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\opera_crashreporter.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.81 --initial-client-data=0x180,0x184,0x188,0x17c,0x18c,0x7ffa90561560,0x7ffa90561570,0x7ffa90561580
        10⤵
        Executes dropped EXE
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.28 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x558378,0x558384,0x558390
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\opera_crashreporter.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.81 --initial-client-data=0x174,0x178,0x17c,0x170,0x180,0x7ffa90561560,0x7ffa90561570,0x7ffa90561580
        11⤵
        Executes dropped EXE
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\opera_crashreporter.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.81 --initial-client-data=0x174,0x178,0x17c,0x170,0x180,0x7ffa90561560,0x7ffa90561570,0x7ffa90561580
        11⤵
        Executes dropped EXE
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\opera_crashreporter.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.81 --initial-client-data=0x174,0x178,0x17c,0x170,0x180,0x7ffa90561560,0x7ffa90561570,0x7ffa90561580
        11⤵
        Executes dropped EXE
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\opera_crashreporter.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.81 --initial-client-data=0x174,0x178,0x17c,0x170,0x180,0x7ffa90561560,0x7ffa90561570,0x7ffa90561580
        7⤵
        Executes dropped EXE
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,7221609664197695803,2555815000795369225,262144 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1964 /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=1852,i,3227215672788739046,18174448944913102259,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1988 /prefetch:11
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Time Discovery
        Enumerates system info in registry
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=2804,i,13681130381924622553,16026094014410387641,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3436 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=2312,i,2576626439606537400,5300602875817125910,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3380 /prefetch:13
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=2816,i,12925732014540250811,13149799952248305821,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3460 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=2788,i,14596543649444385159,14689536316609559780,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3416 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=2828,i,8951231692796816607,12000621486919954329,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3476 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=2840,i,12447762473880696943,18126094091855926696,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3480 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=2780,i,13398805885898650967,15107547777342679849,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3396 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=2924,i,13457763122697612064,16123011816477702485,2097152 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3520 /prefetch:1
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\opera_gx_splash.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\opera_gx_splash.exe" --instance-name=61C8973803226C4D4008DEBC18682105EDAB1556896BB924D0EEB1B6C96AB147
        7⤵
        Executes dropped EXE
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4648,i,3936410034180350926,7989058671858971242,2097152 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4668 /prefetch:1
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4812,i,8702697699775467900,18347202750658521523,2097152 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4816 /prefetch:9
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4980,i,16515606788215851509,7138022585477193214,2097152 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4996 /prefetch:1
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5020,i,14410244618331328248,16013462945447883640,2097152 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5132 /prefetch:1
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --asus-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=5180,i,13606475308121758206,5861357123508306475,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5220 /prefetch:14
        7⤵
        Executes dropped EXE
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --corsair-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=5184,i,8860271692784205127,4716199516642734395,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5164 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --logitech-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=5188,i,7966272800522396963,6800040064162150403,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5232 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --razer-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=5192,i,4223616801049263596,5574672021172020829,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5248 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5840,i,13245859223724464493,12065149310022986450,2097152 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6112 /prefetch:9
        7⤵
        Executes dropped EXE
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6560,i,2270286710252460724,9904386526249920836,2097152 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6564 /prefetch:9
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6704,i,11614060331893679669,3588822007702680484,2097152 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6856 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=7092,i,13340010617726945558,4418468137885603319,2097152 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=7148 /prefetch:1
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=5200,i,15499121008788462518,14654768916939608971,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=6600 /prefetch:12
        7⤵
        Executes dropped EXE
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --pipeid=oauc_pipeF347B60CA73F3F3DA84B31019F4EB851ECFC332513021FC062CC0CA8D8440B54
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.81 --initial-client-data=0x298,0x29c,0x2a0,0x278,0x2a4,0x7ff75a719860,0x7ff75a71986c,0x7ff75a719878
        8⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=7508,i,9438716313002388980,14980791939103101443,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7736 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=7720,i,7391593777642482394,2683304400409682371,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7732 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=7776,i,6904629489560497014,2090188230161681874,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7788 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=7772,i,15175787981525708033,15723677532195706871,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7748 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --edition=std-2 --host=https://autoupdate.opera.com/ --installationdatadir="C:\Users\Admin\AppData\Local\Programs\Opera GX" --installdir="C:\Users\Admin\AppData\Local\Programs\Opera GX" --lang=en-US --pipeid --producttype --requesttype=shutdown --version=133.0.5932.81 --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --firstrunver=133.0.5932.81 --firstrunts=1785425394 --consent-info=eyJzdGF0aXN0aWNzX2NvbGxlY3Rpb25fZW5hYmxlZCI6dHJ1ZSwidXNlcl9leHBlcmllbmNlX21ldHJpY3NfcmVwb3J0aW5nX2VuYWJsZWQiOnRydWV9
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.81 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff75a719860,0x7ff75a71986c,0x7ff75a719878
        8⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=7516,i,6407923228250509047,14989885167272474696,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8180 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=4608,i,16485946130597568408,8366509770579775069,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8156 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:address-bar-specific-affiliation=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-test:DNA-99214_GXCTest10 --metrics-shmem-handle=5652,i,7435048261319329534,8814653199904977934,524288 --field-trial-handle=1968,i,675062869442578419,5183526111084762967,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1972,i,12041528199943224231,14001468465513845857,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=4808 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:11208
  - - C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\opera_package_202607301128471\assistant\Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\opera_package_202607301128471\assistant\Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\opera_package_202607301128471\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\opera_package_202607301128471\assistant\assistant_installer.exe" --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Enumerates system info in registry
      PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\opera_package_202607301128471\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\opera_package_202607301128471\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.28 --initial-client-data=0x230,0x234,0x228,0x22c,0x258,0xd14b80,0xd14b8c,0xd14b98
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:7392

C:\Program Files\Booster\GameBooster.exe
"C:\Program Files\Booster\GameBooster.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:4412
- C:\Program Files\Booster\GameBooster.exe
  "C:\Program Files\Booster\GameBooster.exe" --minimized
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:812

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
PID:7248

C:\Users\Admin\Downloads\Madium\Madium-Installer.exe
"C:\Users\Admin\Downloads\Madium\Madium-Installer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:7848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:7324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM Madium.exe /IM Loader.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:8804
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Madium.exe /IM Loader.exe
    3⤵
    - Kills process with taskkill
    PID:8656

C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
"C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --autostart
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
PID:8644
- C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\opera_crashreporter.exe
  "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.81\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.81 --initial-client-data=0x174,0x178,0x17c,0x170,0x180,0x7ffa90561560,0x7ffa90561570,0x7ffa90561580
  2⤵
  - Executes dropped EXE
  PID:8684

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:9052

C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
"C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe7FAE56220944838BCDB933E86AD23A432FE91C0ADA84DF94778C72EE141B2B1F
1⤵
- Enumerates system info in registry
PID:4580
- C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
  "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.81 --initial-client-data=0x294,0x298,0x29c,0x22c,0x2a0,0x7ff75a719860,0x7ff75a71986c,0x7ff75a719878
  2⤵
  PID:10576

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:10480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:8388

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:8732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GameBooster.exe

Path C:\Program Files\Booster\GameBooster.exe
Size 701KB
SHA256 b0f4bc5773ab22b63c49339e2dd854df5dfe98d3d2ed1181d47fb154b9d535c9
MD5 42ba701b3a7b126946dd5e4442fe0e93
SHA1 1faeee1f3dc4124fdf4b2abecbf378d03e69358a
SHA512 8fc07ef9cdd0b931443691eb8676e73898b20e7ab0c410d8284de7dbc21bcc46782c3126140a51f51ba8d9887ef2e9b5509c17a4b5a1bf7e201f0fcba9d9fe55
SSDEEP 12288:JDENXrsN4JWFMBvD3LQjfiH9WyOjNHYsX:orsqWFMB/QjajsX
TLSH
T147E47D15E6E401F9E0B7E17889624512EB727C568731BACF439065AE8F336D28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 70KB
SHA256 202f6947db28f364478faf1adfb51acbf040157ef4a3e26404b8f1075a0c5d8f
MD5 1f5c87e7e976d26a5d082bfbbb43e5cf
SHA1 25f240f331ff78dc584b3fc047eb9df63034d1b9
SHA512 7d7d174dc67deb8730918f064638cf9cf1bbaf6f2e7d04215b5a6977f940acd9143e2a299afa594f98d1cf6b3dcc15d729b321eb0e77a331a14008fa4d2d91f5
SSDEEP 1536:DGgRo2P4EXELm9zQFG44t0kgAoSuEhsqjwKELAr4Nvoygkm1A7vWPmQ7P:DGg5P4GE8zQFGhYE/EcUNvo0v4D7P
TLSH
T1496302E1CCF31F1103EDD73516A1556CE09EEA7B28E750D7B111B658862B34F9C90E8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 127KB
SHA256 e5f1dabe89a7a1d0ae94bd8e14a273cb5144a6541c34a54192411677c18c43a2
MD5 f944721bd55cbb39c452593638459aa1
SHA1 085940738cf5737b614a586d0f2005ff0445d6e5
SHA512 33c8c2882fc81062027733dc7f1d52f2194957cf94b34c6d71e393ed90f37a378a5c7122cbfe4dc35f7e63c26f7c4440886e9b3884663aea2a8183087611b3af
SSDEEP 24:5bglATIKl7DCmTpHTyxpEo1HM9kvfkzyfkmoyfkoRfkIRfkwhNfkm7usyfk6sRfn:qlg116z1+ukYkwkAkgkw9kugkxkY
TLSH
T107D3356D2F958FEAF0F12770E684BF4CB3D96E6251EFC35E1BCC1906BAA00D01048A85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 100KB
SHA256 27bce9e85eaf3567a4695ba2b612e32615394d80d0a3a2dcb07b1fbfdfababc7
MD5 f134fda98a277b1c8f20ab8fbe2fbd58
SHA1 a922796190a1f5bbb3c410c6ec591502050df04e
SHA512 2b2e8338afb9b0ca9b5fa3d452dfd80368b5d17566120ae6351b6d03572e5a69cedb97f165fbc31ffb3addcc00506a3fc0761cf2404a5d9826a8448a7c4d9f17
SSDEEP 3072:fd/tI0TeVA5o0VgTuGmxrMRZ6aLxuC+Gtn5HBZ4I/:f81VAMuGMrMX6Mxu9+fCo
TLSH
T108A312846579CDBE5EDC1D06AB21ED4CA2BE53F66B5E367483100E054FF4FB49AB0288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a
Size 84KB
SHA256 b02d81653438f2206e406fe74f198c4081b749f7ab9e5a2de8c1fcf349bf0f82
MD5 a06a101f4e9ae9bc3c7185f29d973177
SHA1 71ad19396030d4f261a2b79d182e107583b81016
SHA512 b022a01a0aadcaa3e9f8ede517d02121f852b5d20a3f0e07f76a01d73c412caff82f6ed33f8e8b459706741720002af2c8047988e7c4d96d360348d73cb8c1f4
SSDEEP 1536:X/Vo6Xtocjv/2uDQOwVIC+Qo+kgi1GbP5xunBQ+JPqiCEyDddmWOGPR7hjMHy5sK:X/Ntnj3BwVNfzq3lCEyYGPQHymvMNrY+
TLSH
T10A8302D04C3B7A5463A19924C5CF3A4CD4E1A65F9F97E8AD8C89B39B11F640E3C0E84C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 510KB
SHA256 8dc8f4097b5a5bad430b2cadb82025b3c8008c787c23c9ceb2dd0cf4e87a64bd
MD5 a75e08ca8b9ae95f4e8e26532069a1b1
SHA1 a9cf20af88f29b13c3e0e4197fc41251df2f43d3
SHA512 9f63596890e618d909aa34d8a9c2450c9f7b21a9abecde1fc68686e6e764874a42709ab42bd4a91b9645489bff7b5f8aa896dcc68f69d0b558c62e6ab17ca732
SSDEEP 12288:ZMAiSuSEUojcajDoHz1bqlgadgd9aLwo8LGN9bS:CAySE1m6dCaL2GjbS
TLSH
T1D4B42319A94A9CC1A5FD8F0393F35AA01FE135F44AC9E74529A485F8FF365BB0C241D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 61KB
SHA256 eefff9cdeedb566a325017c2dee686fb17a4146dda81d19c0e1d7863ed0bc050
MD5 6a6075fe83f7d7f89b8177c2abc6c1b7
SHA1 af1ffe5b6d360be3a4f764ce907ebb0d3b5765c5
SHA512 2aca8491fd5665f07e03665ea566b18aad81132828780dba1ca15b995b3f30c82209e73fd49e2d69315c78afd28efa4afe28a9e91c93535ffa0c71650f6af8a7
SSDEEP 1536:p2p0kI0xdGFBhjASJ/3YobnA1v06N7YyMU7Boi:pv0APh3Yyo8Xk
TLSH
T15353122DEF0C6A75E18FE5870E33E85E934BD23E5E809154F0A747B6225E0E0358664B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
Size 45KB
SHA256 e5b9246ffd18e8a12718e3c9efa13f63767ed4c5ea248b6efc22124eb2e3dd9f
MD5 353e6493a6745cfcdf7aa8a7187b91c5
SHA1 96b9151b0ef5f503c5022d6ed03a16e612f30dce
SHA512 7a48311c3798d7829c859e22ca2a2c51918ec6c18708d6e701e2958b1c932e24b051c2500022e074253810b53b634e0d65be2687a35c078a8aeacc8f173633a3
SSDEEP 768:Ljvd89bLrTBUYftcc6qOoWHohDFVwvG+U4v2eCmrb5uAagYE7vrJ+ZMvM2JpOi9P:LjS9bLrTGIqcyothFVwvLBCIb5ut+vrF
TLSH
T12F23F228DE3A65E3DE5910029C2EC487D0FCD50E151D378B8BA71B24E79B9C2AD8F853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f
Size 75KB
SHA256 a3f2c84d2f07bd16dfeeed5d990754acab59f107a29b2d7b12fac3bc099705ac
MD5 22d22b0ac542ae251b271170b1ad356b
SHA1 434678d145eb2b21c07560ca3807a2614134bebd
SHA512 433b02dee05f735921f7012b228ac4c842c59dbb88677a5c43212aac5b172216aabecaef5eb2a40eb1c1a422a0759f6638dffd471bd4f0df21ae86d05170c655
SSDEEP 1536:RpppABuVoVNrclsufEwxCJjShuw+R225E0YCkbnMaymqGkKIKsqHFHpYJlp1:RpjA3ObcxpE260NkbMF/Gkx1
TLSH
T18A7312878642305E756DAF618CD13E481FFA1BE7B892C49D26236BFC80E092F7510D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000021

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021
Size 71KB
SHA256 ca8e81bc0bd83f8f57feea09402e2c234c6122a518c7cb0532feb10c0b340728
MD5 b9144bf6f5c9a7073dd85be433c3211d
SHA1 1c061c91b165604ee1e18e82db9fd9097644c483
SHA512 9c39d858e01d269bf2fcb70330c71358543155c1f573d8c60ef617571e25f5564d845b3896df955bbdf24514a42516427c11fa5fb8ff5297a1025b9a80671cd2
SSDEEP 1536:FAGHLQbFO0GwSJlmEzl2pw8KzeOWlJHpa9ExxvcGqKlze9W4OYY4HFR1oV7P:FAGs5cwclN+lKzeOWnHpaQvBNlziWl6a
TLSH
T1D773120039A9806DF76FE1E506086DD3A917357B111C8362B9CDF40E78F5B41EE28EB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a
Size 21KB
SHA256 de772f8e3ac182a446d62b202a5ad7889b3099e39dcfc0ca5505014c842dc6b3
MD5 3e73b21097fd8484f54f7ae2319c0022
SHA1 53aea255aabf3b4c6f3b83470e2eddcddcfddf38
SHA512 7a2c1b87a79b80027bd3b560be9f5ad11acc4bf5d52e2a54d50545bcfd8d6d7865543374e5e17c5bfd378c0c1cf0f3aa9cd4f41ac7f640b1b73a594f805a3019
SSDEEP 384:BHxam1SlIC1+6y5nkzx6QEZl+7D5FjybwjkXREYlkPfHnqYpba4UL:BsTN+lnkzx6QEZl+f5Zys9Y+nqYp+7L
TLSH
T1C4A2E1283936D4083205C778C1D4304E8B68FFB57DAD27D65A930CD43AB6ACB62ABF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000046

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000046
Size 59KB
SHA256 54f0fbd6ae5af37fc6b348ed08f3816319a1c4f6b475ac39c52a8d9de8407bf2
MD5 d52308dea8cac2fdbd2a5facebaa5488
SHA1 ee638fbe31fbecd0d5ef917ae22a21e2725d0e15
SHA512 a4fd5b84988c54d8fc93b483fed7aa6dc30f95b14d0cffb83819dcda72ce1bfd54ecd6552da9be33ccaf5012d632fd41493c951032f35baeee7d82dbb4800826
SSDEEP 1536:EKPD0w+pc4JKQ7BqJb3xWnNoDLN08XPQFWEpzJ:EzpYQch3xXZPQFT/
TLSH
T1F15302C3116463AEB8EF5AB1AFDAD58FA223E05F0C54358B630502B80C64BC4D8E1B78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000047

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000047
Size 419KB
SHA256 084f493ae76cfd0258b08daaaa14224560e97eea71d9b108691ddf8c676102aa
MD5 fd3a947b47b82863550e1cf3f9c0934d
SHA1 ec31b2f827070a3ec7a161d5b2a8454283f9c4ed
SHA512 3739a0ce2349a9d75ef59349bf886fb780d8e47bb7f3a4b20e028f6c8356602fbfa20758821a70ffe79abec99c22a00fbcab46984fc8c373f758e96e1ae266de
SSDEEP 12288:qdPqUOWs97lEwxPwV6SoGgsn9KI0V/mhxi+9/qm:6V8ldPwV6SjgInhxi+9x
TLSH
T1E79423E9FBFD372DCFA840DF9C408B4755AC743299B22650C39023175AAB7A4D9B4721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006c
Size 61KB
SHA256 bb1d8e7b856d085e64974ae874541ca7f1183d58bd3a6b4c00c7482eb3ec05c7
MD5 23dd6c3e30c3008b1b6fd7c2f414721c
SHA1 b1460a21b69a2b25f956be8bbee72e1deb0d0b62
SHA512 515be667d45a8903b5f85858a2bdfbccccfd25e44497ca13dd7f1cf3fe3e19b3545d339689abc94a5b9fc5277a62f6c8206750cb8c25c020a9ac69793326b979
SSDEEP 1536:9uxVztJjRCtEmSeGmMGO2h4jkHSeTimnlSfXZOF9z3s2qUi:9ChtJ4Eh7mzP3Tit/ZOc2A
TLSH
T1005302411F7B84C9F084BC0E5631A7FA0360EB98BC9C637F51D4046EB4DB18B349B9A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000077
Size 160KB
SHA256 52ef1e774f9b9e87bbb68286812fdd174de540b3866e2ab29d8301865946846c
MD5 6ea5db71beaa95a2091507836daebe9f
SHA1 197e2e8a81f95c6e5f2187253eacb919ac536071
SHA512 fd39ae4f88812a5824046baefcfed8fba25d55c6452a53bfd34fc991cd760bf2e53b2838b36cc1af9977ef80c80115095e5125f99dde5e29240c46b66206fb87
SSDEEP 3072:MwcQ/xctgmSVk6eNSxf2ebpKLYRJVITy3PSW6/KpUwvNWoZqrRREXmr1NWzNcd1F:MYctFSm6eNSgkKLYRJVD3PMIUrROXmp3
TLSH
T1D8F312DCEAAB8C2EBC4DD3B2A521E76493B2053F2532CC152FB4687A70534D4FAC5981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00008c
Size 36KB
SHA256 5c7d09f1c420be28e37050d34c15d2ff55aac52f7200ed38a6ddacfa8cae4cad
MD5 e213770048d90bd71a75d25103345810
SHA1 25091d2158307e129ecef681e685b6d418969dcc
SHA512 5e677e658658664303cbdc889707ecdef0c113e88550de8dafbcf7a671bce629924d63798b97d245cbd1881e2c7c0c8c439983491771966fcc791eb89d50515d
SSDEEP 768:rzZ6vfpeJNmKjCTM3N5T1CLVE7lp7c2QvjghYM+GjML1:rzkvx2NRjL95TyVYl1z6GjML1
TLSH
T134F2F131EC91B9C538B92A60CDE421767DC2D8E81B16F9E31CB47899950C72FC6732A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00008d
Size 27KB
SHA256 476cdac0e6b6f629fe3ef9716991455b515d87dda1651c3be37df4f3d3bc9a36
MD5 8d327694df3ebcbf19980f6553fe85a4
SHA1 ebee1e2e1c18a7df8be0cae7981770823e4db97f
SHA512 1fa16800389256b0a70a4f519fedcc658ece5971f07c363bcb77b7267b1e9c3991b7f74be16db6223ad3b442029e4014e46ea7c87719c25f795204d2967056cc
SSDEEP 384:ETcHVw6m84mwEEfcatfM5Z1ExHETW+UkP5CopPKlm0N1B8zZUjj+QdEFXAyZf+Hq:WgONKatMvPxvAhNQzgSkEFQyB+HeBCw
TLSH
T19DD2E1A88AD991B8A78C823B5CE709C099390D0DFCD7B6537B01FDB41C785CA7B48262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00008e
Size 35KB
SHA256 065e2e668578f472bbf1cbad47ae654f0ccdcd4cbb645b3d2f70f33650eecc60
MD5 9a2e9ca02a41eaf895fc173d72393177
SHA1 1bf6b3f55dda296af468c8d605da687f33efd263
SHA512 753b3a8cc95eb9f52ff961e3ed901bfb6c0f59d9768b95e639fd514ed3585867a699e8ebc2660de1729e3073dfe8cd746600a405865d9e7e4e8690b9bddab232
SSDEEP 768:SV6lcVesIc8Fb9w4jsnNmHIdvhks8UUBAMaawUu9Puc:SVOcVesCwauvhksbgu9Puc
TLSH
T100F202BE6C498A4A96E4385157BD58198BB21D8C31F1BC0CF4FF478ED80409940FBBE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00008f
Size 75KB
SHA256 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
MD5 af7ae505a9eed503f8b8e6982036873e
SHA1 d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c
SHA512 838fefdbc14901f41edf995a78fdac55764cd4912ccb734b8bea4909194582904d8f2afdf2b6c428667912ce4d65681a1044d045d1bc6de2b14113f0315fc892
SSDEEP 1536:/MkbAPfd1vyBKwHz4kco36ZvIaBfRPlajyXUA2jVTc:L0nXnHdfRVEAS2
TLSH
T17D7302E63B6C4943E03D6460708ABE9F104B3AB42FE057E5C876DB7F2722992B71552C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000090
Size 73KB
SHA256 d3caf12591d194712facd10bca14f0a924edb59c24447a3fd994a48286db8843
MD5 cccc9d29470e879e40eb70249d9a2705
SHA1 5fe986cda635681b4b6bbd6111df2f26d7fca286
SHA512 396ec6b4c95e2ecfa5835b44762b588331088d0c06f79e3c0eeca93b7e907bf4695d054f933ec2d0171de11add3cf0c78aa400e9e9b7cd09792707200a5eacb0
SSDEEP 1536:gzbYxDYFYE/bpiVHSBhN2zNjlqMYmWz4F4Fus9Yht/vyMU:gOF6iHSBChgxz429Q/v2
TLSH
T18F7302E1FEA7D81F67729E2B187C32E3E4E64E258F4186D2758E3E32F2254593274904
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000091
Size 73KB
SHA256 3d1080625d3030e88357b3ac9aa377dcec23f1b529c4ad03f7a9a435ccae04be
MD5 44d537ab79f921fde5a28b2c1636f397
SHA1 b2879f9e1d0985a96842bf7f55a2b2cc4c636d04
SHA512 08836d89ba7c7b7645c9de36e2e856cdc31fbb1c3a4a83045848d772720b98d352fb11182471161ef07d01739953a6320355ffecf25a06881bb1111ba02a73cb
SSDEEP 1536:sFUt//lLi8pq0MWeLhkzipMZ4LbW+nNjzw5ytuNCNbqg6g4xNRrFw:99Zpq0MWGhqa/HBnlz8ytuNYWg6ZRrFw
TLSH
T132730235CA0B7289B178227B3CB16645B72981C25E5BC4529F6FD3ACDB0518C35F07AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000092
Size 49KB
SHA256 1765b8a3dc21f7b8ed1f0edc752bef46c12b340d4e7518727494f87d20a91a27
MD5 c95712ce8b80b5cb90ccbe3b9969374f
SHA1 c5e3aee00419bcec46c5f7d74892138f40c3269d
SHA512 f76a0a1854acf07c0fd8d9f558ee87679fbb87f14fa7695014dbc4cf162b60d2b1539f1f65ccc1fe7bc29600a38789b99f061ce8f4cd36e1ab31dc33a4d936a4
SSDEEP 1536:ZMfmyTRGZA4b62TadSbQCY4LBFKcUuSpXQa:tERGZzu9b8XUuSpga
TLSH
T1C033022E482EEDBE46CD360F28684CAE66B3D11266750343D2A0796FD7C46357F830D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000093
Size 32KB
SHA256 d71b2a5861b7ab744661cbc2f182230d243080e6ea9665802d37f878bba0bd0f
MD5 cd7439e77ef8681604b5530d1118d278
SHA1 9130e8de960becf3282acf57f9bc06248760a1a5
SHA512 94500b4ff54c4cbc40a88004960989ac3a10ab23b5d6b5f0191f9934ae304443e130b59d0b8fe7785f2e6e04a588b0cbcf66cfc920a3bf4fb9bf69fe0a63a3ee
SSDEEP 768:Zpaqdhs0NbIj3lhaNAs/FtPYGusm7UcRsJ:ZpaqdhpNb03LcIsaUH
TLSH
T10AE2F11321D03DC28886778C1D4DE815B7EA88F0C1C55E8ADEFF2FA997D57A37205A94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000094
Size 56KB
SHA256 e270416e3c5bf5c6b09054933a6200bf5f2ba11090b1387ec34b2230872f5697
MD5 b839385d9c8d257b79532de72431d839
SHA1 aa374a9f89a7ffc54b4a52db9f680d6842d882a4
SHA512 09649c98dfc15047f3b2d37d7e3c212f09fcaac54ab4f2c8be4b7b5aa01e598be2045702dbb74eb7d68e8f0d3e539e1fb4e93cab29f3624f3a336f5c5f66b8e2
SSDEEP 768:OgTozuL9XuotT2ls6nk6j9JxBlbqo4Q0LF/hUAjPibfYwm19GqmS6S+xQZt6SnkV:72mBVFO9JxBlOV/+xStbnkJVy0P
TLSH
T11B4302F34B744770CFDEA902BC4E50E43259C87A9F9B68AA9293485641BB353BFD7210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000096
Size 27KB
SHA256 2add7d60b1cd2ab84c9967e23d5ec08eb3fc9635c46855b17d59404dec6b410e
MD5 9d503278216c2225184a236c64e0924b
SHA1 0c24c621374506ce70403a7473b47acd86bbf919
SHA512 fa1aca723eb40b6026aa1d21b36ce2573e4164516c9a0b55ff830a434c3954833a06b1df76236b1d682107df1bd3d263ed19cba854c1a6795566a7091749696d
SSDEEP 768:/6zZ6KBVHUlHvwCa0z1sCvODsIBMTKmJ3GG5x4:yzdKvwtszvdNjz4
TLSH
T13CC2E083D14AFB33D0AFB77ADC52D022E9756BCCEC7E587A97A900398895C1B0644285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000097
Size 162KB
SHA256 5a3b98880c968df1e28647ec5e3116cfaed45f49e9bb1c4fc93be6aa98e9d862
MD5 cc61ffec7b99df08731f08db6d49a0a7
SHA1 c0696522251c6a098affe4feb9c5156f2a367ffa
SHA512 e6935fd7b1876554f700168c08e76493ca81f542d388a170c26ae7147e7141c094b70d1dc6c54164b72afba439040431a48e790dd0b9f6b6f32a8fca9ca3e0c4
SSDEEP 3072:Tu1acRa7mCd2qbDK6cF74GoPpVuSQ+/N1CQNbLpab7jOGI7O6Bp:i8qCsqbDK6A5oPpVW+tfAHj76L
TLSH
T149F3125C6316E638DCCEFA3B9D502D388867EA33134017AC7ABDA1C576A0B352E50F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000098
Size 165KB
SHA256 989f4dbf15c64027122dcab1e3434f50c16062ee2c1cac5794b8c37a00905767
MD5 ec3ec67a9216e71ed6c6318de32b42ef
SHA1 b21a96aa527d88fc87081dd14924a6f8471ca3e9
SHA512 cb9f19f0d88678dc064b02a0fbbf2db54622a88213ab63cf7830738d9437bc4e3d5a8b2bdc1dda1fe430591a21fc0c012ec62daeff5596e18901f51751873e5f
SSDEEP 3072:AJeTHcvrLwOx++bRGhGvzi3PibljEEfFPD2VkenXZHEt8FcmLnj:FIvrLwOx++lGAvzi/ejfB2V3nK8FzLnj
TLSH
T176F3127FF3149D767FC0C52932F1E10695F66BA8305B35D3A6A3D545C0AAA42B38B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00009c
Size 66KB
SHA256 471d613e3c1d3150c8c73dbf453d4224771828641fe6150fe8c526b6e3ac6281
MD5 b53e6dd0779932f184d6e2ed670bfb1b
SHA1 a3e45199ba96c7d2a30cb54e83bb6b97463b414f
SHA512 7fcbdaa982cc1cbf06292df00fb8414d8bcec04b8eef9ac63eb8d46febf4b3034633cae6bb655b9e5a329cbdc90224daefcd02a7c90108de47fabc5421521ce7
SSDEEP 1536:R2RKf4MWezRiWO6yvLkOx6g+pJcyp2GpQubqaNHMkQa3sC:XmixyvLzjsJXDGaNHM9C
TLSH
T1AE63025F8445EE452E6A2FCDE768EA14823B1FE93AB70E254D70C6D4E284A145F42E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00009d
Size 21KB
SHA256 5bcc3aa180e7f26f643cd5b2621cd7c2de193d0661d913a94afd3d4881a7a34b
MD5 55cfeb5304f00ff33469dc76a3b30758
SHA1 88d702fdaae15f269299c04f979b674d18c6cf18
SHA512 ce7ac3fd8eb49ee70d47ce174b1a81478079c831502a76b003ada4d6ce8d0bbb1adffb1b34f3e34026757148dfd9296bb85c312219da6e09c74520e0c4998a1e
SSDEEP 384:wTUaaxgF1D9PaaN75l/bEZTZ2EcB32774ZUqOa/6obeu1xrn9jiSnVVpBk:wTUhM1DLN75tbEZVu8cZUvU6oqu19n92
TLSH
T1ECA2E1ECE2974ADE9432B474C3401756163814E57688FE45FEAD36D2E020EADD3C2ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bf

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000bf
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c6

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000c6
Size 56KB
SHA256 6bb3eaaf89b581bfc357bb3b7a265519adf2fef016ee7885c6ac98fc9d059075
MD5 4b056da9a552fe32cb006b4e259a9f5a
SHA1 48dbc5c2a16931fbe52e14beea06f194a0c903d4
SHA512 e0818715ca1cc2c9e82662d55228f96c925826d3a72eb85d643b7f1a4e2dbd10495b4df15bf560a95f9d6b5f3c48a09b556914485b14bc3655cc025d91eb72b5
SSDEEP 1536:8jqxL7wpWuOgobvdwYnWzr0NK+g4BSvXsYjDPIoCoPR:fxfgWuItUND48vXhDPjCoR
TLSH
T19043F163DEE36160C5C6F680B8835994F5FA2ECF1DA77A50440DF8BA07246689B3C9F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000d3
Size 23KB
SHA256 73cdd3a2d35c11f2f222b100885efc8629410207b180e173c553dc3ae13ab54f
MD5 2b2d1ddbda784f99a9f66d08300cd797
SHA1 263e056b11f658999c3d50747e17a5cdd331f166
SHA512 c0674a4c83660b1314ff879406924b19b106f0a3ae43f7930b631bf02e041ab8ddc6f0603f20b6786a4d00a868d20228c4feac0995d4b76c28628db89c289f69
SSDEEP 384:iEo2rR6LROYrakkpU0RQMuYZvsV/H8jL97V4lFJo9rlr5tFikdeIUUPXIYxEGz8m:iJFLROy9I5RQ7YZ2/H8jL97S/Jo95ttb
TLSH
T1C4B2E14854C8731702692B50200CAA96ABF3CE69FD9463F8CD9CB599D04DC6E1A91BD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e7

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000e7
Size 26KB
SHA256 b389e9abbc145501c59265c25d5c46cb2e92f1bb8ef11b68aa79cdc2d8d56e1f
MD5 4cb1107cba12ef049da5795117b52e70
SHA1 144bae1c33b654e3f323d1a9255b9eeccb17686f
SHA512 c732610c3d2654a724cf092df146df002c0dec605baf9b352dc8513bb18175de82241887e648923d6ddada19fe9b0f12d667f194c463afcecab8706c8901ce53
SSDEEP 768:hQXc2DiJ4TDnyI3oHlV0OKzAe2TJMgKrpJEtO8L1kqLWO:Ssr0yI3AltKzJ2TJlKY1kqLWO
TLSH
T1E3C2F27BE662D411527D415BF160E48785E959C204C3EA733ACA3E2F2A030B797B54AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000107

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000107
Size 145KB
SHA256 85fe81274ae9f2f262ba7e190dde79d9c399ac745c8db657f265d6f231625a33
MD5 68d39466f989d370cfc0a8a3b9c98d17
SHA1 aaa7f4bddfb9be03e1ac19aa95ad09e7ca3ff4b8
SHA512 878abc4274b59714c90ff3b14361ebc9718f22a612d83ed8faca76075ff62b7e87bc0c43ae645d7b2d755f8a1cae819884bbbe920d85745e18c5e91728796921
SSDEEP 3072:/Xb8MeU89vJBNiiHLSgjvW88OsFJvnTjpb0VadeZrJCK2SVM0Fjx:/XQ/UCvTl7jvW+6vBbndeZJmSVnFd
TLSH
T142E31233A94261C81685254B75F4EB43BEFA9140DBBD9A11CBE04BCCBEDC5C9D09E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000108

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000108
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 0aa9b37df9e78669d9eb49df5eb8ffd08c12e47d920d1dfc0e119a8fd3f75b94
MD5 f8de87a85605aacf7032e88f19dc543f
SHA1 cbe8cc5d6bb574021e54e8090f008fcd681801cb
SHA512 441507c2a0523c610a96854d67c637e1f59ae2fe673e62e5a40b1a293cc07e066ba3f51b9324699b13af7a7a6fae86d19382a4da22b592db24a90a944a1e424f
SSDEEP 192:yX3KLtuyUFaz5W1TgYnXOazY/+jf5wHvdo:yX3KLtuyD5sPpYGL5D
TLSH
T1A7028326ACEEE714DF56487884D70C1269E845DD9C62CF830668D9706E4F3DE32AB43C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 40d6639db0be21d0b6fe764a944dca213120f37adbb949fe8351edc7816ef0cb
MD5 ae8c061a9033353829fdbb5b38d306ec
SHA1 7a14ff5aa5f86a2ba7d00e7e045e5f9b780b9586
SHA512 98e3254c0b6b23133578d5235d5a998728886fb4b53cfcb6bd90a940d7fafc84a429eb7bc8fb08e7efb0fe0e3f89c06a1cbe31ad8bdbbd101f829aff56527064
TLSH
T1FB7132257CBFA950DF964DBD84A70C061A6554CC8DB8DF8B0A44DAE86A4F3ECB10317D
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 115KB
SHA256 f0b39d02368aeac41426808bac7deb30fbb96b5c263bafbbf018937996c01c35
MD5 8f04c0f143db21d87ee31ef881583c72
SHA1 1b55cd5e30e3546a8d89500743efb601893e0862
SHA512 d8f222bc466a0419a50026c42dda8d84f490c0cbcc1f82fe4da8790a10b3799b1f7c2d781aafa7cba5f7a7fe7ab3605e0b3fea1a21d8630090f807f6cbc8588b
SSDEEP 3072:7WbCGPiPyY9G/nw6IAFArJM6b0NsDT1g91a6blHXcGqG/9G//u:XhTiF
TLSH
T171B33A5F55D499D6CB1CC1F24A690FCA4F3A3D027CD9A0DEF08AB36DE97A6900231D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 4cada822ee228c97c6771f213a1b0da27a32b21d03009cd90060d06fa930c781
MD5 796335305f20c95f44755fea7c63eddd
SHA1 7049d027df12a7a752174d9ba1e32863454df293
SHA512 271542cdb49012c01f131476c2f8751da6b6f22ead4677496cf269ea60dc61b01e967d39aea0b2a1ba09b6649b1870bc54169df9c8c327b9e3368ef00170c181
TLSH
T1AAE0D85C94C9C29F505884AB19B07B4E99AA550C96DDEDA60F43D81470C954854682A0
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 55KB
SHA256 43043f187436b19d27b1f5be8e078eb2c9f3b6f22a325bf12e077047b71163bb
MD5 1acbd6b9bb96ceedd820bea90a8b893f
SHA1 8db5636c166b2cefa7fb87ee547f1b65318f03b0
SHA512 25ce2413492e4bbc166a76b8d2f3748d1af954007e2db76482442855e30c6b767d85188066bcb22f83da0f1dc759dcbcdf78bf52a24e3bfb7fa509ec054632c9
SSDEEP 768:SBkG9TYKr6ErezGKuh0newKgcCK+sR/1yxFb9j:fErezGHFr0Fb9j
TLSH
T1104370F783E4C66E991196F4AB146E1FCE590928032C3D76C9D4AE4BD3E2072E24275F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 651360a6720c74ae6a2f56f6e1f22da19def28cb0f6caa1277374537e740fade
MD5 76f693981a35699de188906cf3cc1255
SHA1 9536bb2c8e733b4bedc947941b58ed4be6886bbe
SHA512 c87b266b586818e62a1e54351c30a2d538529d214566281c18611515ed21ffc1be8edf8f29d036d610324725160d254ec4397b5ea75f1e14a61fb5011eaa8d4e
SSDEEP 384:DKYXeI7GXGGilaR9Jb0Nu7sQXGUWVUZHMAD/3oo7RHaRgSXqu7mIBSN0gaEEIxKI:hlgYijwM
TLSH
T18242F0F7C3E8C62D881156F5EB152E2BCE190A18431C3D6AC9E4BF5FA3E6471E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 63KB
SHA256 c679369920ed534978f6f2479d495be9a6cfbdec0ef414ca7c26195f04201072
MD5 f6036379a15eafb8729f1cb96d596959
SHA1 1391aca744ef7ca73392dd0489a5bf148ec63e02
SHA512 b3d9d003b92a4f521e2a564c8c3677d2c13fe9c29754d71256e3e5f85ce4f38ccc509bfa020aba78a8e52b806dd9752c1faf10dd0dce8db3f78bbbd3eb17d2a7
SSDEEP 768:dBpG9TC4DRErezGKuhigewKgNpv+slU/1Q1Pjlk:iErezGoF4EePjlk
TLSH
T18C537EF7C3E4C66E891196F4AB146E1FCE5D0928432C3D3AC9D5AE4B93E2471E24274E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 32KB
SHA256 5d362892bdd90048cb028cffcc7e19be4ed38d6abff8c75b43c7ab64ef9726af
MD5 d5e373eeafd264e233b117214ef6e491
SHA1 204f98db91f2d7b48951729020f76cacd2a85268
SHA512 24b76f87e4dd7c68cd1cea18262a927b5c19ca0464da8a2d7e3e5cb155bc878f87ce092c8428c5a17ba6310991e31e5d5317ab9395df244aa10fa20e7da84d75
SSDEEP 384:DKYXeI7GXGGilaRoQmBzJheTkJGS9/LfedJVyK4p/MPJLXWWBeeemM6CJdJn0HJB:tlQNsPrUgr98l/JysgjCK4
TLSH
T1A2E29EF7C3E8C62E895156F4AB156E1FCE190924432C3D26C9E9EF4B93F1471E24268E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 67KB
SHA256 104480d3de10f1ec2d846de1cb3deb919c2ed13c48bd4c5010d542c16219b7ee
MD5 da870032051ab6584a8c5b779e6f1872
SHA1 9fadf7cab56ab4ac43964c3d684bf597c1f9900f
SHA512 b393523ec3b5b79bb7b8f3a498c0338835ecdd5827d7524f2e49777c76380a946a5c8cec8c27d95bf2792d859330482a9ea9e3227fae1359d2d55510d8237983
SSDEEP 768:dBQNsPb4DREr2l/KQ4Jg0wKgdpv+sOUn3O1Pjiv:EEr2l/QFXCkPjiv
TLSH
T101638FF7C3E8C66D895156F4AB247E1FCE1D0928532C3D2AC9D5EE4B93E2431E24264E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 617c6108a24332dbe4638db1d34bcbd463aa8aa1647178764014f0c61b6f7c7b
MD5 3fc81140eb7344647767683c8f9510b5
SHA1 abd8ff9d683dfd3da87d88a24d018a846c113fd6
SHA512 f264a0ba00b08874ddf6b0e7100474759ce121ca36bac1f4c73b09acde173d61a0c89f27d8e325b8a4cf55e9e4a0879c74ff4e939735e324275bbaa33f4a66fd
SSDEEP 96:y+1Uo7UE4CUZm/Ukh8GUpU5ieUjsU5URUnpUIUJbUJUvOUwUa5UFPU80UyKULUhH:r1UWUrCUo/U28GUpUHUjsU5URUnpUIUT
TLSH
T190A19DA3E2BFF85B112C49BF2E45BC05257AA83543A2B8F5DE57C1ACB0C15F70716862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2f88189e256b5fd47ce7d4692e1ca8bba67263779b56b00c99621ac663d81016
MD5 ec6003fd4810f1c6cc104b91987cad07
SHA1 50c9f2e0b9ad86d065c40c88b28752fd2fcd7749
SHA512 3ca5cd0bcca19fd1d1640f324927be2ee7695ddb6eafe5539fc7c59c35f49e289649da2f3afd06854a8256012710ccaaf58ad31f4006fcffc040a991aa210576
SSDEEP 192:+RMcBXQaSUv7HgFPRpytdwV9XxHsb+WNDus3Zj9KiOzJR2Pu+eO22+OVyIsnAUgE:+RMmXQhQmXJfw3Kr2P12QE
TLSH
T13752976FAA216A376DDBC219F96A7797D7F6102161D02E40E7FC8A6C11E76CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f06084485c958d79dd7391c0b1b5403e4047f1e8d150d8874a2072b227bfc3b2
MD5 a1f95b37a86f9ec23bec7ebb459cea85
SHA1 8b0d247d691ef4916703bd222c7d3980c1d3302b
SHA512 b493da285e96afa289785661af06db9a737ebb616c60c259b3fb751556eda3aedd2a3320c37ab35bf3db530120795981bcbae6c5d4328050e3f7cfca28cca4de
SSDEEP 192:URsQaBUv7pAPRp2Em9XxHsb+WNnvTqJR2i+eO22+bVyIsnAUgR:URsQCQAXufwr+2B23R
TLSH
T10932A52EBE25693B6DCBC229FA667793D7F6102121D42E44F6FC4A6C11E75CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 057c2ceaabcd52905e10ae9675dd23db785376bec56f45d030c8c108877bbd18
MD5 178795970a707ea8e3a2594804d00864
SHA1 f2e5deaa61b2ce81ca901109112be2e81ba57031
SHA512 a8cca9b4d4fb00bbc7055bea32a131988fafd82707a497b9013fd87b40cd214078af362fdc3224b43f9fd91a92cda291c6996e0d41c886cf2a268892c6e7fd64
SSDEEP 192:MRMcBzQahCv7HeFPRpyRLEC9IgSyKF9apTU9XxHsb+WNVA2sVrLsdJI40DCS+OO4:MRMmzQeOIXEw9fwksUf6Cj2912QE
TLSH
T13272B86BA9201E776DDBC229F915B75AE7F11021A1D05E80FAFC8F1D10DB6CC220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 88f1f68f02abdf9468824196095c49d745534fcff0ecb78d5bc7d0a08d778462
MD5 39cb229e92e70e9ff16bbfadd642b386
SHA1 6f742c2ebe2c92bf2aecfee42052e04fff187c93
SHA512 a62a71f1c4c5da10395ea385779cc40c36599be41ef75e43e910906403eca725c0c0f50f5d55d1bb6abcd07401d693b2020cd99faad82820fb6ac94dfef5894c
SSDEEP 192:2RMcBzlaPnv7HpFPRpyRLEC9IgSyKF9apTU9XxHhgQb+WNVA2sVGyrbdJI40DCSC:2RMmzlsvvXEw9fvMrLUf6Cj2712QH
TLSH
T17572A76BA9201E776DDBC129F965B76BD7F12025A1D05E80EAFC8F1D10E76CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b96db642e92c96121354b2b9be556d0f046d737384cb97c23a75b89d634d2179
MD5 e49f0cd1f1a9542a684806a72d72c9ad
SHA1 e8289932cc43192e0deae1767d961b99fb760267
SHA512 c91829202ba363eb4bafc3b2d59580f3382a6e96b6938c375acc6b647777f3b51e0d29f59cdb748a213551bc3e9f7f54329a3e88cbe6f6eb681eeec2b8429649
SSDEEP 192:MRMcBzQaS3v7HeFPRpytgRs9OTU9XxHsb+WNh2srLsdJpCS+OOBJR2Du+eO22+OO:MRMmzQtfIXQfwlsp6d2D12QE
TLSH
T16262A62FA9216A776DDBC229F925B76BD7F5102161D02E40FAFC8B6D10E76CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2d196ee1b92fc82e2485b1bdd2cb1825035ce92110504955afe53e8e68f09317
MD5 f72a07fbc832b4df52152cecb87b8a65
SHA1 f9a090420466a7818c56e31fcecf466b00eca91b
SHA512 b60b89a0eac7d04b4922f98d68260f8df1b268d890625d149726977cf3a94fad98b29f53b496d3a6e89758b87ccc82e3632cc8b044eecf16be06dff669684c13
SSDEEP 192:+RMcBXQaSxv7HgFPRpytz/E3V9XxHsb+WNQ7ws3Zj9KiOzJR2Pu+eO22+OVyIsnv:+RMmXQhhmXHfwQdKr2P12QE
TLSH
T1C752A62FBA216A376DDBC229F9657767D7F6102161D02E40E7FC8A6C11E76CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1292961e2963489a30d1da1c2496758163952d55cf31ecae50402326f4785521
MD5 9c14ed2a3f0060e035bd79c616907786
SHA1 ae6a3884b20222eaf4029eb42d2f15d18a7ec2a1
SHA512 7e6ff29e580f7c3e071c6df3848075869dc0b04f365a86f48f048348b6a6b50e07d1ac281c8dc64f025ca6160ab7114ee17c69b03c3acfc64db063d489726a3e
SSDEEP 192:+RMcBXQaS3v7HgFPRpytz/ETV9XxHsb+WNQ7ws3Zj9bdJEiOzJR2Au+eO22+OVyN:+RMmXQhfmXPfwQdLwr2A12QE
TLSH
T12952976FA9216A376DDBC229F9657767D7F6202161D02E40FBFC8A6C11E76CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 1115702657925a2b4f0ab83bb66448c2bd48fd0531e858c7b6a0be99fdd251b7
MD5 a5f929c861bc2989d0de742e0d22eb0c
SHA1 0924cd0fea1c5707b49dfe650da0d01fcc976c52
SHA512 cab6be20c0b0f3616cdf1aad882477cddec9354d10c070c7783bd4cf742db22bc8075aaa959bf0bf836b551121ab9b09eae3cd20a9dbed270151ca5895470f90
SSDEEP 192:MRMcBzQaSCv7HeFPRpyRLEC9Ig3yKF9apTU9XxHsb+WNVA2aWrLsdJpCS+OOyu+L:MRMmzQtOIXEw4fwZsp6Cj2z12QE
TLSH
T11472A76BAA205E776DDBC229F915B75AD7F12021A5D05E80FAFC8F1D10EB6CC220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 7de368bcf09dc58092e5d0656c252e9e478ecfd4f86a23e2ea2743186fba3690
MD5 4c9f2e730d1b559a694431083565abd0
SHA1 4d1a89a4c84c2e6d5c22290c488dc31ee97d1227
SHA512 53b1b9be8b24e3f7b0e44f2ca61560c347d63c2565b42ab481060a831aa037a8bea5bf481af6aead50cc75a1395959fe0da95994e5e88b3a149dffdf6f39a409
SSDEEP 192:2RMcBzl2Pnv7HpFPRpyRLEC9IgSyKF9apTU9XxHhgQb+WNVA2sVGyrbdJI40DCSC:2RMmzl4vvXEw9fvMrLUf6Cj2712QH
TLSH
T1C572A76BA9205A776DDBC129F965B76BD7F12021A1D05E80EAFC8F1D10E76CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7945abfbf7732e7fad6954a93156034990eb4e0458b6c3274baeca45f5d5aefa
MD5 bc66239962e05345a04b9b3a2ecbc320
SHA1 bceea7c963db142b86e2c1ea406a593035ea293e
SHA512 d7a7145742d1709af5fe07e0b7d29d2d43ce89de104f30a48e270957835f042a95304bdf7a24107c25b7f1805dec42bc5e7d64110d203c1841d5f665bea50fcf
SSDEEP 192:+RMcBzQaBUv7/APRp2tKKC9XxHsb+WND23Zj9KiOzJR24l+eO22+8VyIsnAUgE:+RMmzQCQWXxfwqKr24U2SE
TLSH
T1CB42962FAA216A376DCBC219F96677A7D7F6102161D42E80E7FC8A6C11E75CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c03b2f98c5f461b6b9b0c3cbafecf12578de3641051abd5d7a3461e7f71de365
MD5 c9e769fc1b85a6c687374f8bd1c98e6e
SHA1 c2052f2778fe0ffd30b4dd631e3c0b618e79d787
SHA512 3e4ab34988b2cb36943b59627e06a541236864ca7cca434521d9bbcb79b6662a061a0ebb9cf15743afb42a28f6cd031c9e60e43bc76bb7e8ee73884ffa9b75c4
SSDEEP 192:+RMcBzQaSUv7/FPRpytGgV9XxHsb+WNDus3Zj9KiOzJR2Pu+eO22+OVyIsnAUgE:+RMmzQhQJXkfw3Kr2P12QE
TLSH
T1D452A76FAA216A376DD7C219F96A77A7D7F6102161D02E40F7FC8A6C11E76CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ba3a46edd5a675afc10b1d170b866d7fdcaf375c52701ca1abec2f14b2440e73
MD5 92099e8c33e31d62c112a6e05f960796
SHA1 c3d49907bef73c8d0d9885c97eb442908ba6cbbc
SHA512 8cfa7067d4160904bab28d991097a0131b407388381113d4dce10aa51a31b144b987ae7c05dbfb0f70de81c4d489a908adb18ac0aea5aff70a3426e04de36915
SSDEEP 192:+RMcBXQaSXv7HgFPRpytz/E3V9XxHsb+WNQ7ws3Zj9bVy+iOzJR2Iu+eO22+OVyN:+RMmXQh/mXHfwQdgWr2I12QE
TLSH
T19452966FAA216A376DDBC229F9657767D7F2102161D02E40EAFC8E6C11E76CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 4d760c5ffdf74e819ec74daec141abf0b9787bb6867c7ac5f0b02af5bc6ec5ef
MD5 55c5868e7c267af38b5505e75380a345
SHA1 d57a87453ff8d359eeb21b7cfb1e3984cec9d570
SHA512 9caff9d1b0444ab762dc850ce1ea71f50bf3c0f81701b609a6474667e24d6ea3977bffa05f1e42ed5ab38f7db09eaec2ce705458831267009b30e910fe6c1fb5
SSDEEP 192:MRMcBzQaSiv7HeFPRpyRLEC9KgFKKF9aCTU9XxHsb+WNh2srLsdJpCS+OOyu+LJd:MRMmzQtuIXEwPfwlsp6Cj2z12QE
TLSH
T1BE62A76BB9205A776DDBC229F925B75AE7F11021A1D05E80FAFC8F1D10E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9cc3c04a547f610421b59ccdd2bdeef0c12dc125e2ee4136c6401d3f97e30689
MD5 6782f554c2e1874f62c887bd51cd4f7d
SHA1 4980c3036b256bcf20d596a0e09d7c800c340c87
SHA512 abd40da036ef612ac13e31c6e36347a3221e0943b3ac1b770655e184d4284b855bb0e7ee9300ae13897e2b48d7110f4bedb2792d1a40d04dbe31c35bad8baa4b
SSDEEP 192:+RsQaBUv7/APRp2tNQm9XxHsb+WNn3Zj9KkMLJR2R+eO22+bVyIsnAUge:+RsQCQWXCfwj+j2Y23e
TLSH
T15442A72FBE216A376DCBC229F9667797D7F6102161952E40F6FC8A6C11EB5CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 376b70b5364a21d1c90f2de05edee426745155a5991e6e1a24103756d47d043e
MD5 93f0663673d924fba7fab0a6619db974
SHA1 2b9080b0467b99ec90cfa854491a343ce1eeeef3
SHA512 4d30bf88ae00b8ba297133386f52a5c7245c60824ce075364188ef131430b6abe3ded889da15767054a0cf8276a5df7fe6eb3afdba55cd3d09d5de8ede18e7b4
SSDEEP 192:MRMcBz0ahCv7HeFPRpyRLEC9IgSyKF9apTU9XxHsb+WNVA2sVrLsdJI40DCS+OO4:MRMmz0eOIXEw9fwksUf6Cj2912QE
TLSH
T1B472B76BA9205E776DDBC229F925B75AE7F11021A5D05E80FAFC8F1D10EB6CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 28d5a7199b4d2b955d96c1b8087b2fc710e898e6d79e0e770384e0d07d44260d
MD5 68c44aea5c1526c0181f81626a40464a
SHA1 ebc92009c1ec037c4d4efffdb21dd9aad5f3b626
SHA512 90cc141706009a3f9f74919d16c60acbaf59a936e7166ab3540804c21e6cdd1f820eb7c040334d1f3896a2e640637747aefc6960565e652d4a0387cfe38af493
SSDEEP 192:+RMcBXQaSPv7HgFPRpytz/E3V9XxHsb+WNQ7ws3Zj9bFI/giOzJR29lu+eO22+OO:+RMmXQhHmXHfwQdgUr2X12QE
TLSH
T19852962FAA216A376DDBC229F9657767D7F2102161D02E40EAFC8E6C11E76CD221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 f39a41a915bdec2688796f37bd2bbf28e6a4d7a675a7ff372f98510bcaae6a6c
MD5 a8d9512af8793e785455b8940b25336b
SHA1 be1485e56ef39954d7f0fc0932ab9e72b35043c2
SHA512 b60fb636a2a45fc558ae96d4c7c68d0b9da9b61ae7e56d9d9650f27e315abff0b754bce7f6313018b9daae7f00e984c8e944ba56310af9a8dd5d0f033cd7cee2
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9g6jBTK8yA:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNTC
TLSH
T1C232D827A48D9E3F4FD8D519DC066F8B6DF5019272780D24A7FF9D0403A978E114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2fb4af7d-a4d4-42fe-8aba-cb863a9d5c8c\index-dir\the-real-index
Size 2KB
SHA256 5d8eb9602ccae8e14f67a4baa0c59abbf69dac1278e85f46ea567ed44b353457
MD5 ff899fc742592bf27225d2c94ae1e943
SHA1 30f0301c759d607f5f0efa9837d57de218c0572d
SHA512 fa7bd89a2e95ee0ce6c1e2098624d57f88edc2e385ab8c210add4465b00bd8d72bdec8aa88d639683959df4e96c65a1e2bf0bf68722e74065a79bdb86f43d368
TLSH
T113512E4CCC90A7AEE871A0BE2D9418B253753C24FC69C792C1D8B2B534132B95B839FD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c5617.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2fb4af7d-a4d4-42fe-8aba-cb863a9d5c8c\index-dir\the-real-index~RFe5c5617.TMP
Size 48B
SHA256 7c7c31bcbe041056cc8e923dcfbb0eab796e56e9a0a6224441faa84a93d6444f
MD5 9e2b2a011d6cd6efa39b3f173fc6ec03
SHA1 df805fe4f9b26254d29271eb0e8a87784c780106
SHA512 702319f831d2542df945f5acaa303f1c3777ea9af9ff94e0e1f2227e5bf87936e7685c3df039530ad906bdd3cc46293be6522ab4b5e6c11042f5cbcb2ba6a329
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b364535d-4d58-437e-bb38-8de3df5a5561\index-dir\the-real-index
Size 576B
SHA256 407275c48b1027ba3b2d669602678a81df9ce19c132d7a79af974f5442c6ccbd
MD5 2bec5910028a39c0b09c60176bbd9087
SHA1 5ff17bd5f6f06b3f3a149d6bc6eb0a1604828593
SHA512 c7ebaf9a084101f0a66fc13591f0bd9d50282a05736b85823b1c543a035e87575f7e2cea513d148be1d1ad9ab4a80dc683569ed1e7dd4b5a25914e47979dd275
TLSH
T139F0F16952D85045EEE38FF20437341013B5104E0E0E3F134478653AAEBBD150831501
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c5a0e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b364535d-4d58-437e-bb38-8de3df5a5561\index-dir\the-real-index~RFe5c5a0e.TMP
Size 48B
SHA256 51512a5e47cda4849382e7e34274af8a92d8a25888e856ad6e2b1244aeab4e6b
MD5 3eed32fba95acbe3b43702c00c5ffd82
SHA1 2d8896502edcf68e185eeb127b63f211b7dd60cc
SHA512 0393e61c26ba293fe6d1b1bb6eec71e1bdd71d3479265c1a4742d90d3a44b23543d524fce5aa2470911ee61c2de57c07911d5a7e72e4a481f0169375ca4aaafd
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 04760f4e8d7827fb03c45cca2d8a82a4ecdfedb32c377aa1549975f59db49751
MD5 6ae666ed45b33a54d13786ad0646946b
SHA1 c24e47ac3f1f4d8cec4cf3567d674342b4b7ab5a
SHA512 ceabebb4df44bbf8c24619b2f5363272cec87b20030920ed656b95fe9fda642c793b573578c178a238c47b9c5bf7e2062e32b847a27c2ac8b6be660440d514dc
TLSH
T1DFD023D9413148571534DB8C513C961D911F8D0DDCCDDDDCC408F057B4F5602C412D36
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 99de308129437034015b126b6cd271ce0f4dd4252fa7c9c530f27839c0d93e48
MD5 6dd55c579df2ea4aa6f9b7e0519bd98a
SHA1 170fe6219ec56185b701a308d1c5465ac71ff9e1
SHA512 37d773c66a0e45a6c8e280fdd464cab307d284b0e78d6a8c29081838f8bb31302f517e1377e289efa28c48656488e2b0e1c88bb6b1e7598feda621f18054ffc4
TLSH
T1A1C09BD6541149975931DBC41578672DE14FC14DCCC4CDE8D009D047B575D125813D26
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 241B
SHA256 122092da1388e4c5d409bf692a18ff00f7aae32a5185852a062cabec00d96a51
MD5 8afd1740b99b8d0f6c39a116be2ae34f
SHA1 19f1a200a72a622b266d078d50bdf7cb61a8de67
SHA512 3b7ad4a4fb0a04c5be349a4169ebcda05e94351c4cccec630d840cf8a7072939fc1f787cf5fc9f8760640e90292be6b8008b66f8d7055e79fd4ea52d1bdecdfe
TLSH
T16CD097C26431488392328EC03138A36EC24FCD8CCCC2CDD88104B006B171C12C032E24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 239B
SHA256 72e337a5cd6de135f2eae95de81edd4d83435f04c7d84702912cdda3c88f867c
MD5 79e5076933e92bf067dae1695efcd3b7
SHA1 b27b36d966fc6ee47ac6a7554e2fd5f7d56a706b
SHA512 dc9ccec7f2833564f3a232c9ecc3aba58ffc773d9ac45bd6f08cd0b72e0585fde4122a3e8cf176abf73b8ffa5924cbbf8f1e8e77fbaadeaf0513806175bab19e
TLSH
T17ED05EC6A9621883A5368AD43538A36ED14B9189CCC68EA855188246B2B6D22E031A25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5bf1de.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5bf1de.TMP
Size 137B
SHA256 24ccb6f3882bca144f7c7349002a75f1ed8e172f29aa9aac9935243084ce4104
MD5 b9ab5560aa6e22862fb3ceb8b3e6ccfd
SHA1 2b741bb81e197fa1c4e047e07aa0675abea9af8b
SHA512 1539c0247b4598a4218feefa58978f7220b1096f2d556c316250bfa1e9af9a485393d722209c1695d933949eacb44e866f3936cec7497a7c5ec344a6c6ec291d
TLSH
T1FFC02BC6002108834B3255C01138630DE00FCC4ECCC5CCE8D00AF003F0359138401C21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 da418688d406465b1f9c52f08ad3e4ebe253038c389f7abc54b4e33eefb2e0ab
MD5 ff255437d2948a13132cd7bdddcbe3f4
SHA1 f3e4fafcbda4d41d545cee2e29dcbb2d6954a8d0
SHA512 5882d797749c5cd8271f6dd59000a21d53667f3dccfd05d60a77ba13d2697a4e8d85f04082288a5ec7211247b1af24c0fe5a14de90c5815ceffa60a9b7b48e5d
TLSH
T17CC01286D84E61A2CC44C1F09809104E31606F3584127A4A8BF077F5989B0A0412216C
MD5 SHA1 SHA512 TLSH

Submit Download

afcf65f0265837f1_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\afcf65f0265837f1_0
Size 255KB
SHA256 381453ae80f638b346084db925f1ff56d596a9012852ed37a71f9480c513864d
MD5 0d3cec178fa667319fe5debc629e5c68
SHA1 123f2ec40741d4e9b7315d2edbdc56e1d04654fb
SHA512 fbb8014844c54fc400809195a756e026f42721f135d1909aa07f5a1706bed374ab26545ff39d6fe893914c5c5106e3a845ce3541441030070f64bcf8509c6fa4
SSDEEP 6144:nIjv/6CNHJ3ghfu0OqA4oPuqhDo4E4cH515w5P5+rIP7U0WwN8H:nIjiG0Rje5Do4E4036hWIP7U0WwN8H
TLSH
T142447D723300A53FA8278AA1E67E7F4D3835E217DD2706B8D2E4E9358FD6DFA1412548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 3a2194624d38c1634a3a312b23400c3fe802f5e7a8b7c5875795b7298e1b0b61
MD5 4dbc0e18cd8610d06358aba000cf3233
SHA1 999a2fd5693313eed377f344794c048332214c82
SHA512 446f084a9f031bea3354ca40f7945a807d9069f65c2be2f7f9671d4f6928f8df5a7b023ff5a049858025f32c2f54dc4016e66cd645bfda9114df0aa1d4c2dca9
TLSH
T150B0017900544A56C94692B81AEA05A03B735D21238A929691AAC5688962296A31A685
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 cf232f577443dbfc15de6ae0d4481cef9d481e6f9d67902cd5fef9726676c3c3
MD5 d7f53d822f6e59d96794e0691c054d01
SHA1 41ea05e4ea44da5c99375bbfc8986d9c67a85861
SHA512 20890ac27bc740d405b9d028bda5a7493201899a9e01d0d0b756640b69006cd4e43f632daf038505bda9218830e9493a8c59f0f1f9d39b317df1704994deb629
TLSH
T107A0023041D26852DD14A2706061074173538C359E91C70356B60849887F1C54709215
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8906580983d9eec0148ecbe54be639e3c3e7ca5824ae97d0ffb593d31dde7d13
MD5 2e1e2a93e601a38940b467150a89e3e5
SHA1 48b5cd586aa54fc336afc009f748d6aa7109b35a
SHA512 280e96400b1a9e3445490e443caf53654880b180e6294791a8d2bb88f4269ed3e75088678e2b0cfbc40bf64b0d283d5605d2c4d28569c3b1c359ba849afca1c8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1972_1270022348\Shortcuts Menu Icons\0\512.png
Size 4KB
SHA256 d345d2dbe2efd56ff9494cb31cae0e28cde5bdf176a22bca9aee27465b117c88
MD5 97193e4d969021cb6e6ad1b25bb7499a
SHA1 69cb3acd8bc0b31b63791efc9dc47d5657bbf40b
SHA512 1df06713846ea152089ea40434f3fcff250ba2d2c0b5afcbc546b82a65b68f3ad1cf503dbc4e8246765c01f191b4f8389c4c55efb7da507f443d858a8dfd704b
SSDEEP 96:TTcYKfambSQTNpzzBOWUjfRVS/TFm9BfyKhnaBS8ZP9jeLWfbOGp:SbSQTNh9gD+mLfB49ZILWfCW
TLSH
T1B0A1968E8CB5488E66658747D48538A2C5B030A7A7BFC3BE719D174851E32C6FF29B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1972_1270022348\Shortcuts Menu Icons\1\512.png
Size 7KB
SHA256 1e0b1b2e4dac49da1e2ce91a72e01f77fdb3bbb26ed3422e5d4037745cc307a4
MD5 cc525d60c0dc9696ddfe9524dc9abe82
SHA1 fc94cbd2a45bf2ff0fbe411f57a7cafa31126bfd
SHA512 09ab42f7dc3d6a08b9635ef229539a5c4c240506378a9de4eccf1f69d52b266222cdf084e9a567c6d21f19e61c4da7ccd98928870d6f10cd74e9158c64a4142e
SSDEEP 192:U3/tgbWgm8Xl2X+xqWwB3kUXPmv9rCywxAQU:2/rgXXExWKdXPa+txrU
TLSH
T159F1AF6F639B59EA3AF8493D4BD7A21FD62E108A2F275B71C5101045628A1C1FC69F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1972_1270022348\Shortcuts Menu Icons\2\512.png
Size 9KB
SHA256 ad08077126e7106674e4219f5f9cfac2305e8b3f627247c1d3e72136399e6fd2
MD5 660ae59d489be5b5e1e9036b88b4a033
SHA1 b1ebdb9421bf14b5c43a399b4dbd92288d91a604
SHA512 3bf52f4d1e92ececb7691bedf1f53dea75041615447eac2c1ec9f99d07417a571e08fbd2db58896506350e8af831e8fc943d35e35747a8cb6db9a03d880331f9
SSDEEP 192:uJTyU9sUZdxl59pfNK8EliT9Tjx/t0xM6LwZx4nwBmJH/Rr6O:g9sUxXM8iiJKMfcTJIO
TLSH
T1F022BE9744E4E7A3427CAEBF4684D914DF4E1B7384366E10020B199F0D7AA8268E8B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 ac2782263c7c5987afc58fe79f8db934c2a83b5e09a634475714852f5960afb5
MD5 86965727ae8f79cf271edf182621dce7
SHA1 832e067e1c6bec385f3ae241fe4e9e7d0436de2d
SHA512 dca6381dcccbcff359ebb8585a9bb6857382c0824f30d70b34d838a8ec22ea4bbb616eb2b9fe63f1c625eeaa2d5c83ca791823e98c009f47e5890afd18f4cb71
TLSH
T179C02BE30400868F8F74D9CC202C313CD40B414C4CC0CCFCD44891163038A33800293E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a5c69.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5a5c69.TMP
Size 157B
SHA256 1ddce23c8dbb8ea270f4b8fe201e65f028f0fc1d0caf42e4199f0a308f219721
MD5 d115c63e6d7f56d673a44813f9e6c8fe
SHA1 39f55c6d681d4c348427778ef6e0817ec1085ec1
SHA512 fbfe817a23f2f3d5f1e7027238a3ed98d5311ed702dd15b48d696eedd6259ed707a453fb6af065464decbb89051124e679fed2e72c402a5dcef764c12232565e
TLSH
T1A9C08CE30410028B8F3195C92028312CD41B4C4D4CC0CCFC9059B2163038A33810192A
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\322ebacf-3774-4dd5-a62c-3b81a3d5d038\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\322ebacf-3774-4dd5-a62c-3b81a3d5d038\index-dir\the-real-index
Size 72B
SHA256 b74fecc8af175867e665e5995bebf241f3462132672d7419328f4acfd31722fb
MD5 df22f272bb011e03c30f7e8418d32abd
SHA1 207135ae15968ec142b5446178005d478b4a867f
SHA512 67d687e029104a1e5298567005f3729676cabd2ed36c80e62435c5b751154244bdbedf7b89623bcbc720920df93da8063f35efcb76036a1ce168228d267c65de
TLSH
T1DEA0026D4A599213C8200374285741A732318990FD0D9622E2E03184C8971AB410717C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ab71c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\322ebacf-3774-4dd5-a62c-3b81a3d5d038\index-dir\the-real-index~RFe5ab71c.TMP
Size 48B
SHA256 8346a07fb12f5dfecbe99ebd9f8a44ad474a177c811c3e245cc4dca6138bfbbd
MD5 84c6a3bf5b1378b5d5baa6145dbfb864
SHA1 03716c26f87077ca611a844fabec0ba1beed939b
SHA512 1b6b931d522dacf3188898b204c72e351a063a036377be14af504f5b57f7414e80991d586183bffebe3bba89dc9ba1e7ea544531aff25a80eb329975d2d0d545
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 234B
SHA256 0fd4b1abe83e1e38254d913738f13b8c6966d86b3a5bb3c7c83465cf578569a9
MD5 025c0db1debd77891c4cafc1da6e3403
SHA1 cacb7b6dfa4d7e3230a733e36fe90784690a405f
SHA512 2294bfd8d06b240405ee9c3a39b745505875f59f6c34b9e2608dba25b403cb9bbfe6c5d0527c86bda57d66207a824fb3bc9546b027d587502d189e04f0d2c599
TLSH
T18ED0A7EB163145476B34AD945428364DC02B5C089CD4DCFC8C84B05279746B38102AB8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 150B
SHA256 3c7e794f6fc5ebb65ce4957c725a58334744679172c37e678d0820410ad363ac
MD5 390a28ffe5c744fe7bf644aa0c9cc624
SHA1 84ad77c2c35d4bfbd41ea87e25568ab91198e0e0
SHA512 39d5597df52431f6094494251d48709e737766f0590531df2a4d6d3b9b7e35bb8ff8ce98c36f1667648de17d24e33136072dfe31ee2cde51b02850cdc1f57936
TLSH
T17AC04CE71924458B0A749ED815287B1DD11B454C98E0C9E89984650269345364502E78
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 151B
SHA256 4d71f8de8fe3ea84f68ed1c0b9d0873f4b51d792511078877332e111d1b083c6
MD5 9d605eebfee4edadd14bb53bc40c1573
SHA1 6fb18901d331c77d600bcec72c1eee89215f35af
SHA512 4014adb2849e9b10db3f6ca810e3b1652d33e902dafa831cbc2b2fad5f6875a176abf097886626df951844e1c703f2ba2788d360cf457fd88629282e8b447360
TLSH
T1ECC04CE71924458B0A709AD8153C7A5DD11B454C9CE0CAE89984650265745364512E78
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a5f29.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt~RFe5a5f29.TMP
Size 157B
SHA256 71e6fc66a6219dab8e51fe70446fb16bf9087ab779d775d125c88a99d7b5d5e5
MD5 51e7a019bbd63181b9f28d64efb7ae84
SHA1 d77bd553e4bb774776c754c6c4ccb08897575ee6
SHA512 5422b850735e750e5d050888e4e75d4b977c26350c4fb43ad756e123c4ea653614038bcbdd4399f1d631f0412f70244f1540e374ea3c6e76b25a46878a3a3c2f
TLSH
T179C08CE3082001870B705AC810383A0CD12B4C0C8CE0C9E88885700275344224201E78
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\CacheStorage\c57783db-60c9-4288-bfa7-a22600fc42e0\index-dir\the-real-index
Size 72B
SHA256 ad5ebc69fb4594a7fbd6a82d54c1a44cfe6f17939faacda44e7bd2694ee455c5
MD5 854019b03177517a7a2dae5063bd3d3b
SHA1 29a6b81c0fa0af13a97d020684f5a9b89d1a2bf3
SHA512 949d65211c9169bf6b4541e1a503e7f83274c2ff3d4241016a74f3ddd9e55dc8959cdea991b14358ae7fdf15238b2f973e7b7e3ffeaf30d7fdfa074529b8cfcc
TLSH
T1AAA002384A504205D81517716C4B016D72318914FA09424385E73194C9D65A6472757C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cb6e4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\CacheStorage\c57783db-60c9-4288-bfa7-a22600fc42e0\index-dir\the-real-index~RFe5cb6e4.TMP
Size 48B
SHA256 840288210d99438dd4c6cbeb8f7f4088ca8409ebd9e9510db164af2c40d5812b
MD5 d1b81be2ab5bc2fd7f1c5afb8f94e489
SHA1 13be82aabb16d0a67390b95320f3dd2a70f67e3b
SHA512 6f1d871f4c64f2ac9c581ff566bb23ceec64a936ea08bc221050add34064c01d07bfb275d0de2289dde71c5aeb9f29b87fc55067928d6b493c2af9950e76b4f3
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\CacheStorage\index.txt
Size 78B
SHA256 2a1e34dacf49e39147aa248ec893db25a3ff1171514a9c2eb437d95971f81779
MD5 df6f9eca4e8046581684d543ee81f3b0
SHA1 b98271e3cea06103cf1878da09a8c789ecfe4a1d
SHA512 1e8424448732077ad796b9ee21d69f4ad670db117e974ea25e2d66123a530e0b83913426b4d93d52af5a350244b3f81290082c0dd249eb5a75e9ab2de715614b
TLSH
T1D4A001A7580580AA2B62A8E87068B21DE18B828C8DC1CDF4880998862539A6601139A0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\CacheStorage\index.txt
Size 159B
SHA256 43efd0f75ec62e49480c2e5a248bdc2a692104a1f2b90f0619d9752be5f6558e
MD5 ab71148c4d775afcc884a9d58dbfa7ba
SHA1 df93746ab1f80be18a7fd1db297d36def4653c0b
SHA512 a9704c5bb0d0247db00559f6ec5cd5492ea115386c9f842ab755c836c9c813cc072cc41109595aad5f6699c044554cfa2501f5d106463500f252a7dae2221174
TLSH
T165C08C9B28204467073694D8702C724DD2AB4E4E4CC4CCB8A405748A31389178107AB0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\CacheStorage\index.txt
Size 153B
SHA256 8c4cb61069005f7d28e3b6334d666808f740ba3724152e888b9cb44b6d3d0c34
MD5 ab2aa96b01f0a44f829c29e1198a5a15
SHA1 c07612f240123655db8dcacb8de7159a684b378a
SHA512 4a8dd6b4226b633abeefab78181d168eb1e9aaad4a8b0362b84473dfff98f054a7f91714d650646a3c1a9b239e6f84e0fcd34cf3b88c774ad34e4b41d8ae1e8c
TLSH
T172C08C9B6820806A0B3195D8301C724DD29B424D8CC4CCB8A408448A217899648136B1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5c65b7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\CacheStorage\index.txt~RFe5c65b7.TMP
Size 162B
SHA256 da65c1fa71d4d367a79b22c4c7d640979cbdd395a6c08896bfa01795335208f1
MD5 06d29bab8661bcdafbfc4d7f30b93c86
SHA1 8f13c12145582608b748548302bb90070c00e960
SHA512 b4efabdb9776c1fe28679ba952b5f86e22dced601839552f62d646a370edf48190ebe248440c4f220bc47aea4a4570771c277ef6ec195f8babbd19b21e618191
TLSH
T138C08C97893280AA2722D4D4B428214CD1675E4CACC0CDB88921B4A2687CA2180236A0
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fdff2260-0f0d-46d2-9ff8-36b7d4778425\1
Size 4.5MB
SHA256 4b0af4781ac80f2e59ea90e390b5fa49c126c947b0e1295b800d3329332b0548
MD5 4b110339b2dc76eb1b088a09da65254a
SHA1 8d973a94c777d343ebbe2ab02301bdf6d4ddd610
SHA512 6d484a07cf0beea8a483b48ee0c5f968888ff82b30ee90295ac3021c273ec07e0cda9c971a686ae3f6a32955a69c7d763dfb03f23c59097798b8d1e0aa6225e2
SSDEEP 49152:rYz5u2xdpiNYZUmyewbYSoXyEdjWNkf289jJqhaRgXx3g/YMXNCl0Qa8grenjbP9:UBdaSKV9D
TLSH
T17C264BD8F2A5343513A7A165D07F150AB27F658AC00C4468F5B9CEFA1EF8A09523BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 638502bdb3200b12fee6cddb51e1654642ff1b92c21c84036e4ea45a59bafb4f
MD5 8853df92102ae205b234b7b0a2a4a380
SHA1 9096f2d214763560adfd7577617739ee54ffdb24
SHA512 fefc56b77d3186822ef063c808b35274c20e8ead57e4d84b29f62ca3c5354d7973061181020c6f85b5062c41bc5935e3e6276ab8445fc8bae92f448b83850b26
SSDEEP 3072:TXbqhY98Tkalsr0vFiS91xILSacIQitL9vdrjYai5bQ1pV:7bhck6sr0vF191xGSD/itJVXYD5U1L
TLSH
T1C7D302717C242D9656B101C43287394ABEA0C477DFC575E8B1E9AF4E18AF15C8F0AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 2508e8fa7f5e987665d7bc4af61799ad1f65c6745a7c473d624d18a9d3d0cf61
MD5 61b4c57297847f58cdb376c7174f163d
SHA1 cb4f48254f3eb6a31a80867973777f7cbd8aaccf
SHA512 b1a182ea7e30853f5ae36ff8eb861eaea47de94605392fa90d58e9308fb1b7f20fc0b86b653de4817ad86cbafc79bca2523791d24e3165b399210c937f1082d2
SSDEEP 3072:ZXbqhY98Tkalsr0vFiS91xILSacIQitL9vdrjYai5bQ1pV:xbhck6sr0vF191xGSD/itJVXYD5U1L
TLSH
T17ED302717C242D9666B101C43287394ABEA0C477DFC575E8B1E9AF4E18AF15C8E0AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 20566ef077d325ba79571cf5a9fe80ecea8c877798f82a0a8702780b07a9001e
MD5 d0e351ed37eef8b880b1b1268d73dac0
SHA1 e4aa51be218cd63a12ca9f5bfe98ef473808835d
SHA512 1a6be521c188ca9747c21153a00362570747a59274d2fec988a86cbb34f5ea96c10a943ddf758af65b44a24a0a08aa6c11f17c0eded0ebd410699686000387d4
SSDEEP 3072:OXbqhY98Tkalsr0vFiS91xILSacIQitL9vdrjYai5bQ1pV:2bhck6sr0vF191xGSD/itJVXYD5U1L
TLSH
T146D302717C242D9666B101C43287394ABEA0C477DFC575E8B1E9AF4E18AF15C8E0AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 1b36383f031962540fa180ec951c64475c6717f823953643a096a6e5060947bb
MD5 0282da90b1ff6802e26bb2d2aef036f9
SHA1 f7a83443a763dca1c27ad0c0fdc1a76a74009300
SHA512 2d4c1d0eda24bda9028a35bcb8487d7b9fd47c4dcaf0009cea755e24e38336f5eee3644094b6d03d25f3c3a8286d9ec1e8b4725f83cdcf9266b4a73c98c945f3
SSDEEP 3072:dXbqhY98Tkalsr0vFiS91xILSacIQitL9vdrjYai5bQ1pV:Nbhck6sr0vF191xGSD/itJVXYD5U1L
TLSH
T18FD302717C242D9656B101C43287394ABEA0C477DFC575E8B1E9AF4E18AF15C8E0AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 baf77ff3f70a54097ec12b1f06c286697eed49580696f446120a4e9f7c70e411
MD5 ceed347fd34a7da824018613da084170
SHA1 3e78ae0c6f96f26de2182117d2ab64364df0cf95
SHA512 79c970019152c49119a00684cbe6a053880f6b1eb7c0818dd8f3a604ba4b186f0ac4ccf3bb9d224de873ec1334e2ac3bba8972f78e3e463323d59ffc3a2e8aac
SSDEEP 3072:LXbqhY98Tkalsr0vFiS91xILSacIQitL9vdrjYai5bQ1pV:jbhck6sr0vF191xGSD/itJVXYD5U1L
TLSH
T1AED302717C242D9656B101C43287394ABEA0C477DFC575E8B1E9AF4E18AF15C8E0AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 528346c1666963c1bc7a9574fd3be83fefecb635210c85ac2806ed219c8d3f83
MD5 1d2ca3d2ac0284fe95ff81760456bc03
SHA1 54b7c4b2101ed6a87592784448ac54ab23f2f605
SHA512 2c2fcc2436b591646dce34c56864593b05c816429859213bc61cfba5bca0f0d74b98e1f9222a1c2a5c4c28a85b996fa5075225b5361cd22d39c15874d17cc8a0
SSDEEP 3072:q5XbqhY98Tkalsr0vFiS91xILSacIQitL9vdrjYai5bQ1pV:qRbhck6sr0vF191xGSD/itJVXYD5U1L
TLSH
T16EC312457C341D5666A502843297354AFBB08533DBC524F5F2EAAF4E1CFF16C8B0AA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 bfe832f1e78106e0c5799f578f5383d853c7c6fdc922741163cf80a9835c0721
MD5 897f24f959c949f6c519a4aa2fd620a5
SHA1 b02d52a19ae8a1970f8c97e8918763c764d309f5
SHA512 7486d35dabc815d493e4601451751832fb23e1afcf588d8cbad916610be3ca8012162634a37c38347f927317925c153957c2d5ad3be4ad4bf8021ce6e2db7bd0
SSDEEP 3072:NXbqhY98Tkalsr0vFiS91xILSacIQitL9vdrjYai5bQ1pV:dbhck6sr0vF191xGSD/itJVXYD5U1L
TLSH
T1F3D302727C242D9656B101C43247394ABEA0C477DFC575E8B1E9AF4F18AF16C8E0AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 af71edf638bd4f61a66b78ce90beae22c0856f9035b271e549bf4d9beebea089
MD5 aeca9b60eea58b7c15b97c70c4980563
SHA1 a0aeecd88584b259a0a389772ab605426e6d6175
SHA512 56600e7a0b681ae45498e073be3e14deca95ee4835c7d90e93b9b89529cb659674e0541f5ca903be48b09d2aed12d62bb9d034222a419e9596023914c5562248
SSDEEP 3072:NXbqhY98Tkalsr0vFiS91xILSacIQitL9vdrjYai5bQ1pV:dbhck6sr0vF191xGSD/itJVXYD5U1L
TLSH
T174D302727C242D9656B101C03247394ABEA0C477DFC575E8B1E9AF4F18AF15C8E0AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 a4de1d8e8a089f5ff8bf4b8cc05dae1141615e6a3dfdce87ac65046eb6e0c556
MD5 33bda0f8f0b19cb5a30dafbf1ac12028
SHA1 f4403e063ba766db46aec7597d477ba4a3678002
SHA512 6fc8b18afaf5144a6ab6442cdd0255640b11740b532232f7a76f4af1c0117eab09e58c97648a54101a31a700f118d3a031a9921253a808dfb4c78fc6838d47ca
SSDEEP 3072:jXbqhY98Tkalsr0vFiS91xILSacIQitL9vdrjYai5bQ1pV:rbhck6sr0vF191xGSD/itJVXYD5U1L
TLSH
T133D302727C242D9656B101C43247394ABEA0C477DFC575E8B1E9AF4F18AF16C8E0AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 eeabdeb69af235c0093e4c75f2b319b820836afa1791f1d433ed1f45d6225a6b
MD5 bdca2e93ba0aa4e304b6fafde5c3fc47
SHA1 8eeb773fe61ba0f65cedc4b69c3d52543c2627d0
SHA512 2f5b6808d4c7d0282fcc077c3a2ce5b6b7025c63a0371f4e4a723637e4be6f7508fc0073a0053f59766cbdbf72d92927edaa9156869b7e3cc1e06837f7f20741
SSDEEP 3072:6XbqhY98Tkalsr0vFiS91xILSacIQitL9vdrjYai5bQ1pV:qbhck6sr0vF191xGSD/itJVXYD5U1L
TLSH
T120D302727C242D9656B101C43287394ABEA0C477DFC575E8B1E9AF4E18AF15C8F0AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 dd3705c4161f12a3abc2325f1d7904d4cf877a8dc518d73aac56df1ec776ce54
MD5 c9e3706cbec8bec312c515647d3b4976
SHA1 33454859465f671e31494baf11b984b9eca9b8ce
SHA512 83f712c99f70b39e7f33653a9cc1271a160014cd4eab89fe68d4815e953994483f8ff424a7fbfd7af7f53fd4e4e3955866ba053308de29bacff9df80e94e0117
SSDEEP 3072:/5XbqhY98Tkalsr0vFiS91xILSacIQitL9vdrjYai5bQ1pV:/Rbhck6sr0vF191xGSD/itJVXYD5U1L
TLSH
T142C312457C341D5666A502843297354AFBB08533DBC524F5F2EAAF4E1CFF16C8B0AA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 89ed5139ab76f0c060a95d1deef216ef693fa0b1d38858994af712669a889096
MD5 c2d583baf9669c4dbd24b3beaf8c88d5
SHA1 d5710e0c1dc14e8cd112a74e16b7672abed8e564
SHA512 80fe27b72dc505c68d4a3f96de5052f223cbf9958c6c0a7399f37cd3f8dde1e4b106611d70dfc46ad90a2eae87406e494ec9fe92600b5e8ee63f5e2e178dc924
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5pmDSB6nGyvn0b4T8/ybJv4a:xC0ITo+TQ0InDUDiyPPb4T8/ybl
TLSH
T192A10835A0284DB74477D44AF1626A83CFB9706BE9B2AF90EAD90F0D15F70EC1341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 46e563977c365d9bb03d94e28948d91a851c11fc476d90151fb12dfc0054c500
MD5 ac9990b24afc5e20e6c53ff5e3c276e2
SHA1 72ae8c88f27726682d2908500a5c4aa917baced3
SHA512 789dd0b3718ede242ee8575bdb5d3ce1cd6d647a143bfb8d081ba48a9ac337d782a50ac9ee0f78d52b56641d6d897c594c26620ed5583e7c9522a5e9fa9361c3
SSDEEP 3072:25XbqhY98Tkalsr0vFiS91xILSacIQitL9vdrjYai5bQ1pV:2Rbhck6sr0vF191xGSD/itJVXYD5U1L
TLSH
T1CEC312457C341D5666A502843297354AFBB08533DBC524F5F2EAAF4E1CFF16C8B0AA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperaGX_42526205.exe

Path C:\Users\Admin\AppData\Local\OperaGX_42526205.exe
Size 3.9MB
SHA256 b429250e578b1ebfb08575471050fa2079f124217e458f5e796d581ce3b1d6ae
MD5 d8705ed5c9056a2a53e3a1a896fc97f7
SHA1 3274ea90b6d158deca0b675057cacb9612d21e2d
SHA512 9ab820def3f6c6c6d4ddc123023ff160fad12c867e3c05f4c1e7c48866a4efe051ddfed23a31734f43b8fa2c84503f7f7e8766b2bd836f3e56402dc4f196ba68
SSDEEP 98304:NA+O4QUh9mlN1MTulTh34TQUe8DQP+F+6gd:5O+wlNDThoTQUeYM+F+T
TLSH
T1CF163312BBC58075C9B331310FA5F7A816FFF5260F2656AB638C06AA9E706819731F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Opera GX Browser.lnk

Path C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\opera_package_202607301128471\Opera GX Browser.lnk
Size 1KB
SHA256 7d96eabbdf8b129f9a2638fa09528bd1e807247b6039798805832778f34f49d5
MD5 2d166c05348e5356ff6661116da8b0e3
SHA1 03e4256bfe03107ed828c74741fa982f304b97ad
SHA512 3ff67f7b83f8da759b7e05a56e56bd1f7171d81e4862621c2045a89d3a0862c108a01353d42cfd8b99fdea45818ea73cb63375f16de62a60c57393bdd635c935
TLSH
T1FE211D122FDD2B22F3FA963100B63A768236F850AF1A9F080148C3581E31603E968F1F
MD5 SHA1 SHA512 TLSH

Submit Download

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\opera_package_202607301128471\additional_file0.tmp
Size 2.8MB
SHA256 0f50bda78a34e09ccfd5e33a7958de9eebe9863cc3d875e8b9c52dec3f3a9992
MD5 1bed04ab23ee645cad438456a6d465fa
SHA1 68b7d9eb6ff0bd159281a2fd55a7a24860ba765c
SHA512 9ca295d1c574e88eb8506ba3bb4096ff3860e605b7870fe11a2eff27c85a551894345b7524485fb4fd5ed5e9cfbefb917f735ed51085cfd3adbabd9a28909f23
SSDEEP 49152:MkinoAcJ53ld/JCHyHuw+yIfBfnDWUKT5qDztnvkbPsGaW6EYFZoMzu3ug:MkioJJ57RCH2uryIfi0mz+W6Eory3ug
TLSH
T1E0D533317D918476D22392330DD5FBEC66BFF5B22F229A9B3388072EAF201A24715557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\opera_package_202607301128471\installer_prefs_include.json
Size 342B
SHA256 829ea3c9b3bb423bb131b0cd3b03eb1d3a12eb61754c0edeb0a9eae6181a0445
MD5 f0d1e590f3601a949dc687b8401fd81b
SHA1 f5e44ae371db2fac87d40df1d7088af511e49e72
SHA512 0276f542980743c9d496f7a84c0ce1e0ea81a347eeff0c819efc9e9212b3bf478f4cf2b0e15a7cf04b6665d497bb2881e4f6fb84e8d4fc850d4a5bffc1bab57d
TLSH
T145E02010516DE0A2EFFE654738B233CC09D3140254F6BC8C678B5551013EC2535D6F5C
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\opera_package_202607301128471\installer_prefs_include.json
Size 357B
SHA256 8c26bb58346addf8cfda59a7d3ca47c592bba73354d3583c6d846a6819ce049a
MD5 d397959cbed798f534881ce8be22ff0a
SHA1 75014b823ce49b161210d9a6abb17925e1627ee5
SHA512 f5448003a3b58fb01400030673ba3ae044cf84c93ca4bbf155e806e4d44acee0f26cf20b53a177b379250ec7a266a42d678abbc1d1d81e27dfb4cf6fab56a869
TLSH
T1A7E0D8245169E0A6EFFA668638B232CC49D3150254F6BC8C67CB5551013EC6635D6F6C
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\5324ee1b-dae2-435b-97f7-1918b18d2e42 Opera GX Installer Temp\opera_package_202607301128471\installer_prefs_include.json
Size 1KB
SHA256 6c553d43d073adcc77b50a236f68626ae7208de970bb060f10367603fb27cd31
MD5 090251485fe0a510763969e1d5c4a05d
SHA1 3848724b2bea88f541032ffa3049a253abae8748
SHA512 3051679d1a1cb19fcf0ca6bcd453336b387a334315f74174a5d893ef3f8308849e4ada2d14c5d287454f7d4cb98e82b25a46416a493ce258daab32977212408f
TLSH
T1DE1186288049B031FF7E428BEB9735855987040384AC58CC99CB846259FFC111FFAF2E
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0FBC3EBD\installer.exe
Size 9.1MB
SHA256 94e544bce1fb4f965564026d1f61eb1bf8e0f750305b1a2c82ea8a445ebb9f1a
MD5 061711589ae8a06d2bc54489c7ee1a13
SHA1 c8b0da3e2352758308d6a98293a6c3bbd70a2a29
SHA512 fcf4c99618359eb8cd0372931b2a3ad5e9b50e0404dea0c716633d1c7ba262d6973adabd859033aa650cde30e04091e88296dfe2a73a903dea5132a7a8bde16d
SSDEEP 98304:ea+ZNcMT++pJDFh113LvdDCDfImZU7QgaHG9fHFBI3++wteEmw:6NcMTbBh1Nl+BG63+Bqw
TLSH
T1D3A68D53F3EA11E8D0AFCA748B7A523299757C464B34A3DF0A9436250E75ED49B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1972_81192625\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1972_81192625\CRX_INSTALL\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

file.txt

Path C:\Users\Admin\AppData\Local\file.txt
Size 58B
SHA256 06252208cf28d99f264bbdfbccb79b67212e1b3f993c5181f89ca780cfefbb1a
MD5 3168fccf3d0838e4741f913269285ca8
SHA1 bed8c2d7d042df0c17d2f4468d0291e5becdca75
SHA512 cd99e0a8b4c5227e4b78c81805169f1e49426262ce8d03e62e35f6ae05bbc1316ab3a5afcddb6d0eb03bb7dd5a1dbcc09fd78df2509827ab7470674043d05e5a
TLSH
T1F9A0022695D5608E9915DA4AB7A0245014E49187117DD295DC205701880664A10A2565
MD5 SHA1 SHA512 TLSH

Submit Download

Madium.exe

Path C:\Users\Admin\AppData\Roaming\Madium\Bin\Madium.exe
Size 318KB
SHA256 31e3a2d1095425dee31b654ee439307fe0a3642fd8ba8170ec15152812b96466
MD5 a47e4f94b1788054c536be5ec2c2e952
SHA1 c74ea2b9af88870f2a55a00aa994e4c36e6da013
SHA512 a5b84cafbc0008259e66896cedc10c1ee298917b92a73508adb3d3f371de5b2c24be481de0053b5906b784d07b31ebef2e9214c36dcc4ff89cbd6f067d1abfdc
SSDEEP 6144:wh9ycwiNpAe9pI5Te0xqdtlAjr0+2m7jyxWQ8CbvXgddOeJ5PTQYbeHxHA7op9hu:69ycwiNpAe9pI5Te0xqdtlAjr0+2m7jH
TLSH
T10D643CB1A0B5E33E019F278BF1709710C7A7934BD7595AE2E42EC6A84783C88FB93055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 7KB
SHA256 09e6e437ccbfe695dd0db3b177e99eb0b19e51e8c4945e99ce404477dbfff952
MD5 ca83b2627fcdf2be9bda16a5595efea3
SHA1 e8b6abe7b9d6e9c4ab7baab5e7cb58f7474dafe2
SHA512 71ef47e9fe5c16211f9dcdea67f8dc328452ed2dfdd2cb2d55b2b011c8cdcf732e95b664ad09485888f20c6898ab5b6ce87f47386d4aaa0a7d6df8caf5aae518
SSDEEP 96:4r0nF1nJ1VXP/QsF5nwJ1VgP/Q/FR385XFglaNh:wyxVg2qV/Npc1nh
TLSH
T147F19F0967F51629F1F3CB36E9F13B225E36FD0299189A4E55D1C3052C71A006ED973B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 8KB
SHA256 29df5a9670f375ebf8ea75295139fd484d897226ff45bac312bde20c192baaaf
MD5 2c3c9b29203dd880e8e77bb014d8c134
SHA1 3cc63981abd325655984edd59e011ad3abc643af
SHA512 2218e2a00d0efdf130efb56580750d9f66b291a4cc2a03e5cbce2858e2ff391f035c345b506773c59798864e2b2256ff49bbab3bc093fcd1dd5204c73aaa1c4f
SSDEEP 96:4FfJNF0nF1nJ1VXP/QNF5nwJ1VgP/QSFR385WFglaNh:ahryxVgrqV/0pcgnh
TLSH
T136129F0667F61A29F1F3CA37E8F13B125E36FD0299189A4E56D1C3092C71A006ED9777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 7KB
SHA256 8cc904297d376eb9acc4b720e1f922358c2a004dafb24df628f3bb134e00de4a
MD5 17c428377de3e479dbf3764cc11cea58
SHA1 862e6bd275b0be45a84387b6106211b4eeb57204
SHA512 e4e01bda4f5cea08c9eb06f5e52406ba792f7db599dc6dca04c2d58f1ab589fead244b0b415cd7075cb8fd86803cfe19c6200b9610972f17ba98e1405bcaa686
SSDEEP 96:3F8GaFfJaF0nF1nJ1VXP/Q9FR385ZFglaNh:VRshsyxVgbpcPnh
TLSH
T1B2F1AD0667F61A19F1F3CA37A8B23B225F77FD028918DA4A56D1C3091C71A006ED9B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83197761-4907-4fb2-a04e-0762e99f2890.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\83197761-4907-4fb2-a04e-0762e99f2890.tmp
Size 2KB
SHA256 f505f1e5093b91140f515ce55ebefec4121588eccf102e7999987feb24ac14c1
MD5 b2c5bea43887efa29f53556bb1303f95
SHA1 06d40567482a91d0c110b4e6a24b404f700bddb3
SHA512 997169a8f2d7e4dfeda67512563f64437869515a570985f890bb3427699d1bc7134d051ec6ff974a5b74fc81cc7641b7c910fda0c5a47b42268632ddd024d6e5
TLSH
T14C5119716458CD3B5A724B5EF2467E03EBE90003C3805F94D4ED0E0915FB6AC176683A
MD5 SHA1 SHA512 TLSH

Submit Download

8a445001-1850-43c2-ab1d-231666856b10.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\8a445001-1850-43c2-ab1d-231666856b10.tmp
Size 151B
SHA256 2de0f4d04369c6e9a13a61e6a420822251bb3d0d0ed3a0ffa29fd08d5192d639
MD5 ce4ea7b6f9373c2a4238e7dc031d7dfb
SHA1 9b9005e2a45e14b39e5faeb020326e6f5166da4a
SHA512 23d282346e6aea32133c4cb7aa4e1610498d6ffb20daa7c3015330bdce3fed81c8c31d127c7dbf02ebefebdc2e434c3740acb6427870d4dd929a4fd5a9939a89
TLSH
T16CC08C0D22834407F4E2068CB2107618C296B20BCAD6EC22A1F40B0249A022226A6024
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 2b511ff2e17ed78eb73e596f48244b412553333f4fbf62df7b40e2ea8a5a03da
MD5 6a524df284b8dd05b2189412e2f6d1ee
SHA1 436513122eb22b74bcf69df67ff5ee2066ce6f29
SHA512 2128aa6dfe8c8ac6ddb5eccdee42d2be97c5fab7bbf72555e248cf6e9095b98908138cc167fd56cb4c286fae89372702ef57036a38f82cf47830deb57c69a113
MD5 SHA1 SHA512

Submit Download

140bd1b2-6c0d-499c-b1b5-2905a0b1c4f6.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\140bd1b2-6c0d-499c-b1b5-2905a0b1c4f6.tmp
Size 327B
SHA256 f2c5ffc3736a7b32860c2176efb45f3ae3a5f60fb04666634bd849181fcc1f00
MD5 31f979d269269b62c20c7c2f91e872e2
SHA1 b44a3281acb76e998563213feb0246b0e5871168
SHA512 367391c40c42c4676751be093b6b81add5939601b8109dec45fe1e83ebddc496d148272315357407dbfd5e556077955d37219646c9ed163a2f83ede63c0fb905
TLSH
T1C8E07D4AF8618514E8882FF671AC792383AE4580495867A0CCDF604D422E51C8B1D630
MD5 SHA1 SHA512 TLSH

Submit Download

2c7e3fe8-85ea-4aa0-87a4-2de0697ca150.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\2c7e3fe8-85ea-4aa0-87a4-2de0697ca150.tmp
Size 162KB
SHA256 5903c920e584fc5f1e918bd641bf58fd56e8cb20bb68269892a4984ea7538621
MD5 6c07e783fb8030c2aae67919d45965f7
SHA1 46d2d931e5049884b4e4af1c247fbb1a25b6edea
SHA512 f93944f08885b666c7ad9ab5d7ea051280cd636286586fe1ed696ad67c3b43683fe87dac24bcb9410395acff59a5b0d12d4c12c2f44a0963af2cd93c939a9aa5
SSDEEP 1536:EEJFyMduylKOn7MU+AO8iKqqFG0urH6PtOE:RHKcuGjFhurHjE
TLSH
T1F6F364823BC1ACB7CE92A6B52F7CD4E9B372F5084746572B7FE1A2718B9D3180950139
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

349a2954-e37e-4663-b2ed-e060fc36dc74.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\349a2954-e37e-4663-b2ed-e060fc36dc74.tmp
Size 19KB
SHA256 834553d15fb36807b2ccff1be6e1cf778bf65182205c45f8ebc37a32fec8e6f3
MD5 e933777076e7ef12bb24d8777cfd0a7e
SHA1 6ef2ca5a472636e6e9ce9f15bbda58d533a7f2ad
SHA512 08fdb6d916e05a91c878b25c3d30147e432f5fa5663f8a15a74c73d8f69205c55c5ff886d67efb6def735e06db0b03b34c6bc3eb1662483166092be020c2a96a
SSDEEP 192:712To7eavbcsvrk1uevRKN9aWNtNscXnlOHfdAvBZhV85pKRADs+V:pKoS8NwuIfu1OkBZc5DDs+V
TLSH
T10C920D37C5079CAB817013D564FAB617F685232F9AC88E8B36BCD84D8F35923725670A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34c5d485-606c-487d-8ae6-5c16b7511efa.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\34c5d485-606c-487d-8ae6-5c16b7511efa.tmp
Size 10KB
SHA256 d015ace74043c4dd2727425df6111ed3cfcc8c381c78347f61ca5ebaf290fcb1
MD5 ca0abb50339e9a8d3345313b9f608cfb
SHA1 475d3a894d79d415bdf37b76f58ef183f138334f
SHA512 9da59ac2917675473b82e05f7f3d9e0122c4fd57b02da18b3566d650df813457e51019759291964ec3d78e3300589b0133e4140140b55ef22693676f294604bf
SSDEEP 192:mXjb9VMr/Z89DTfRFui4EXM/QY0XHsUmfeQKUhtw8qIyizIRXb+WNOT9eCyIsn2B:mHXT/q/
TLSH
T15832114BA9604EBA19D29625F690B757F2E60120D261BD94F7F8CD2C00E72DC3522DEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bookmarks

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Bookmarks
Size 21KB
SHA256 8a67d45253d8e0a56db448ecf8322669c76ae64fdc0263e00e9ee38ec189ac92
MD5 96c7370bc1016c37adb567d7153d95e2
SHA1 9e1fa6f3d8526fab6a19b52c932cba40ab094db2
SHA512 2fbdf8151092fafca3dc4ab287c5299744c9b8744cb64b05dabfb768426e7509092a6e4ff5c0d63f87b292c1710ec3cf0f11d136a157248f0650d3c95adbf698
SSDEEP 192:k2Nqq+wUSrtmPtKQHES1m1CCiGSaKRA3/3BI2Ovg4hGP4HCB0cQAys+V:koq9AoFzEp1WGWRGvvO5xwmAys+V
TLSH
T173A24037C506ACAB417503D568FAB60BF685232F57848E8B777CD88D8F319237256B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

239ea7e0-84c8-4876-9c06-1f4d050cc051.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\239ea7e0-84c8-4876-9c06-1f4d050cc051.tmp
Size 48B
SHA256 3944a20d7ae24d03c2370f23e453c289ece508a4dce1257800d1c1a6e1444313
MD5 be8635531580341ef871c026b36bd56e
SHA1 89b97d97f2c076982a8d7fe7b2fc92beb55358bd
SHA512 efe58f8f54399aafa00ebaf0481aa04c23177df4a9582ad95deacb1635dff9630f515fd7d770f2f8d25302702b6e0c418aa8f222de1d6b518b0b88617604146e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 5a0a262750a61d9430bef5be878b3553890c45a16f1d6e7bf2f4bc5f6dc2ef05
MD5 98086c98e9bbce0e2567326a3534c2df
SHA1 c55bbd6dba414b1e4850cc88112647212ce74ce6
SHA512 d91641111ce00b9916a4a74c100b56950298143753cfb52f6e9521259dc189c48f2fd1cd1ec084611ddb5ace991a5b9b8f912fdac448f38f2de9e61e66de1a25
TLSH
T1F3E0A9B970EC1046CFC602F212E28CA301802D72CC010B9B37D2D2770A9F1E60321040
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences
Size 15KB
SHA256 3b1112abad1692f77e0fd8aeb6c3f78e353414ffadb1c1d9b4fc4e1acb754afb
MD5 84e3a3ee83d24eaf71de2ba2f98fc4d8
SHA1 f51764ce9bc375a580ec6376c775190eef50a8e4
SHA512 89b574bbadc9b25e0259e562262c2a38ca64a89052c3b9cf7c6b7ec556b73986bd7dcd56ad5f35d5e46b82c567827c287501dd5e088f8d00ea79e4ab6c481586
SSDEEP 192:muM4jbouVMr/Z89DTfRFui4EXM/QY0XHsUmfeQKUhtw8qIyizIRXb+WNFdBEdsTu:muMgXTSpjGsQDi
TLSH
T1D662468BA8219FBA69D39521F6847256E1FB0024F2556DA4A3F9CC1C00EF3DD73135AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3352374-ca46-4137-882a-8443ade52a74.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\a3352374-ca46-4137-882a-8443ade52a74.tmp
Size 72B
SHA256 e58aa0f72c877f69e26840007b79f26d5f6fbbea4a01b3d867356afd45bba9aa
MD5 ae8d13e3fb06f16c368b2cf19794bff6
SHA1 10927be734e11c72bf8083910f43a3c0e57c6032
SHA512 7587e7c9f99146e389855ee67100dae9f21f5061e10afb36ed4df149e532900ca6a1611ab4883464651a40ac62a2143dec4186e145cac646cb4f827e566284f5
TLSH
T167A0025103408111D2401AB4790583891364FF6584000327B6D517469C60060CA11144
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 b44cecc1b92e63e2d4ce227df46196e66f71d534afa9cbbcf599986715678a04
MD5 b8e4f584692472b52ec124d04742440c
SHA1 b08a7256417b38e5386392b492660c5f2fb35ddb
SHA512 fe5229276f92bd20f7df8541eba1013bb9bfe663260642284edaa825c95f80acab5977d9a66315e22cbeb0e0e156bcf8fef9735fd607dcaffa2b1713114a8bef
MD5 SHA1 SHA512

Submit Download

beb6012d-4c30-4595-80c4-2d5f94eff5a9.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\beb6012d-4c30-4595-80c4-2d5f94eff5a9.tmp
Size 429B
SHA256 f42def54bccfcebbad8cd9736499a7332889d509c4205b07c0e8d181bf2ba77e
MD5 c8df1eda9f8019b5e364ca20c712e9df
SHA1 935205f52f2ae283c45993a5ce76c5dc9ec22137
SHA512 eed060e7d81ac883e6ca76b9552cd110f6b967c5d585b671f334c9d0b926bcbda96a38b7b0781407944107489b4256f051421e0427ccb45f0facea98e3af4746
TLSH
T1E3E023B5127C3783FE013597D076522E5881B6616E491546E0C4BF6B102E821438E7A2
MD5 SHA1 SHA512 TLSH

Submit Download