Overview

overview

8

Static

static

3

VapeInjector.exe

windows10-ltsc_2021-x64

8

VapeInjector.exe

windows11-21h2-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    207s
  • max time network
    270s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    28/08/2026, 04:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VapeInjector.exe
  • Size 22.2MB
  • Sample260828-e7dfestbkb
  • SHA256 08ad80885743b3c78de6d6f14ffa5c22a433324c443e765c1e16046033a59da0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Downloads MZ/PE file 4 IoCs
  • Checks computer location settings 2 TTPs 20 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 3 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 16 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 5 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VapeInjector.exe
    "C:\Users\Admin\AppData\Local\Temp\VapeInjector.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:560
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Checks processor information in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:224
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff954e9c728,0x7ff954e9c734,0x7ff954e9c740
      2⤵
        PID:4772
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1640,i,3896295076744638760,6402812961385315101,524288 --field-trial-handle=2436,i,7782447178488506495,12514230146837104535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2464 /prefetch:3
        2⤵
        • Downloads MZ/PE file
        • System Time Discovery
        PID:1920
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,4214604515705976845,14594077188595390971,262144 --field-trial-handle=2436,i,7782447178488506495,12514230146837104535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2432 /prefetch:2
        2⤵
          PID:60
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2076,i,2413984809642267282,8957780257635616726,524288 --field-trial-handle=2436,i,7782447178488506495,12514230146837104535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2496 /prefetch:8
          2⤵
            PID:4008
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,17703579189037581105,2296023208641312275,2097152 --field-trial-handle=2436,i,7782447178488506495,12514230146837104535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
            2⤵
              PID:856
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,1024436245274888292,5071059154650620891,2097152 --field-trial-handle=2436,i,7782447178488506495,12514230146837104535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:1
              2⤵
                PID:2076
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4352,i,7289728012205464833,8400449294775254330,2097152 --field-trial-handle=2436,i,7782447178488506495,12514230146837104535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4516 /prefetch:2
                2⤵
                  PID:1848
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,11950370494557383328,8358448596301343183,2097152 --field-trial-handle=2436,i,7782447178488506495,12514230146837104535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4784 /prefetch:1
                  2⤵
                    PID:4776
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,4221001210358957451,9871328840887529999,524288 --field-trial-handle=2436,i,7782447178488506495,12514230146837104535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5352 /prefetch:8
                    2⤵
                      PID:2192
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5712,i,3058981043389966269,3704670783287946727,2097152 --field-trial-handle=2436,i,7782447178488506495,12514230146837104535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5544 /prefetch:1
                      2⤵
                        PID:408
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5828,i,15511672067315360341,9204770456424657202,2097152 --field-trial-handle=2436,i,7782447178488506495,12514230146837104535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4684 /prefetch:1
                        2⤵
                          PID:3680
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3412,i,2698662243753691036,13429734109915645431,2097152 --field-trial-handle=2436,i,7782447178488506495,12514230146837104535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3872 /prefetch:1
                          2⤵
                            PID:4440
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,2297283875981854903,11471628122406984624,524288 --field-trial-handle=2436,i,7782447178488506495,12514230146837104535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6108 /prefetch:8
                            2⤵
                              PID:4680
                            • C:\Users\Admin\Downloads\TLauncher-Installer-1.9.5.1.exe
                              "C:\Users\Admin\Downloads\TLauncher-Installer-1.9.5.1.exe"
                              2⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:2204
                              • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3969818 "__IRAFN:C:\Users\Admin\Downloads\TLauncher-Installer-1.9.5.1.exe" "__IRCT:3" "__IRTSS:26673860" "__IRSID:S-1-5-21-42486406-2033776002-1658862356-1000"
                                3⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:5088
                                • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
                                  "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
                                  4⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3648
                                  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                    "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:3839250 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:3869932" "__IRSID:S-1-5-21-42486406-2033776002-1658862356-1000"
                                    5⤵
                                    • Downloads MZ/PE file
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:3116
                                    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                      "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
                                      6⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:4972
                                      • C:\Users\Admin\AppData\Local\Temp\7zSC637FB79\installer.exe
                                        C:\Users\Admin\AppData\Local\Temp\7zSC637FB79\installer.exe --silent --allusers=0 --server-tracking-blob=MGZkYzg0ZDgwNzM2ZTU3Mzk0ZDEzZGZjZjQzNGVmYmMwNjRhNWJlZTBjOTA1YWJjMDljNDkyYWNhZTI5Y2IzNzp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInRpbWVzdGFtcCI6IjE3ODc4OTE3NzQuMDY5NSIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOC4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFHWCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiZDlhYjlhMjYtYzkxZi00YmEzLWJkOTgtYmE4NzJkNjhiN2M1In0=
                                        7⤵
                                        • Downloads MZ/PE file
                                        • Executes dropped EXE
                                        • Enumerates connected drives
                                        • Enumerates system info in registry
                                        • Modifies system certificate store
                                        • Suspicious use of WriteProcessMemory
                                        PID:4920
                                        • C:\Users\Admin\AppData\Local\Temp\7zSC637FB79\installer.exe
                                          C:\Users\Admin\AppData\Local\Temp\7zSC637FB79\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=135.0.5973.57 --initial-client-data=0x290,0x294,0x298,0x28c,0x29c,0x7ff6d07c1608,0x7ff6d07c1618,0x7ff6d07c1628
                                          8⤵
                                          • Executes dropped EXE
                                          PID:420
                                        • C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\installer.exe
                                          "C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\installer.exe" --version
                                          8⤵
                                          • Executes dropped EXE
                                          PID:464
                                        • C:\Users\Admin\AppData\Local\Temp\7zSC637FB79\installer.exe
                                          "C:\Users\Admin\AppData\Local\Temp\7zSC637FB79\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=4920 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_20260828053616" --session-guid=bf45899d-ca1c-4c99-8655-5f560e8792fd --server-tracking-blob="YzMzNWEwOTJmMzNiMmU4M2YyNGVkNzEzZTAzODUwMWZiYzQ3ODNjNzQ3OTM3ZTE4M2Y5MzU0MmY3MTU1YjQ4NDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc4Nzg5MTc3NC4wNjk1IiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSA4LjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYUdYIiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJNU1RMIn0sInV1aWQiOiJkOWFiOWEyNi1jOTFmLTRiYTMtYmQ5OC1iYTg3MmQ2OGI3YzUifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=9808000000000000
                                          8⤵
                                          • Executes dropped EXE
                                          • Enumerates connected drives
                                          • Enumerates system info in registry
                                          • Suspicious use of WriteProcessMemory
                                          PID:1432
                                          • C:\Users\Admin\AppData\Local\Temp\7zSC637FB79\installer.exe
                                            C:\Users\Admin\AppData\Local\Temp\7zSC637FB79\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=135.0.5973.57 --initial-client-data=0x29c,0x2a0,0x2a4,0x26c,0x2a8,0x7ff6d07c1608,0x7ff6d07c1618,0x7ff6d07c1628
                                            9⤵
                                            • Executes dropped EXE
                                            PID:4824
                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\installer.exe
                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\installer.exe" --backend --initial-pid=4920 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161" --session-guid=bf45899d-ca1c-4c99-8655-5f560e8792fd --server-tracking-blob="YzMzNWEwOTJmMzNiMmU4M2YyNGVkNzEzZTAzODUwMWZiYzQ3ODNjNzQ3OTM3ZTE4M2Y5MzU0MmY3MTU1YjQ4NDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc4Nzg5MTc3NC4wNjk1IiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSA4LjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYUdYIiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJNU1RMIn0sInV1aWQiOiJkOWFiOWEyNi1jOTFmLTRiYTMtYmQ5OC1iYTg3MmQ2OGI3YzUifQ== " --silent --desktopshortcut=1 --install-subfolder=134.0.5954.67
                                            9⤵
                                            • Executes dropped EXE
                                            • Enumerates connected drives
                                            • Modifies registry class
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:6044
                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\installer.exe
                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x7ff7ac12bd88,0x7ff7ac12bd94,0x7ff7ac12bda0
                                              10⤵
                                              • Executes dropped EXE
                                              PID:6080
                                            • C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161\assistant\assistant_installer.exe
                                              "C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --copyonly=0 --allusers=0
                                              10⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Adds Run key to start application
                                              • System Location Discovery: System Language Discovery
                                              • Enumerates system info in registry
                                              • Modifies Internet Explorer settings
                                              • Suspicious use of WriteProcessMemory
                                              PID:5148
                                              • C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161\assistant\assistant_installer.exe
                                                "C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0xc4cb80,0xc4cb8c,0xc4cb98
                                                11⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • System Location Discovery: System Language Discovery
                                                PID:5252
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --run-assistant --allusers=0
                                                11⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • System Location Discovery: System Language Discovery
                                                • Enumerates system info in registry
                                                • Suspicious use of WriteProcessMemory
                                                PID:5308
                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x2fcb80,0x2fcb8c,0x2fcb98
                                                  12⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5328
                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe"
                                                  12⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  • Enumerates system info in registry
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:6160
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                    13⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Enumerates system info in registry
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:6172
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe
                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x19c,0x1a0,0x198,0x168,0x194,0x7ff9406b5310,0x7ff9406b5320,0x7ff9406b5330
                                                      14⤵
                                                      • Executes dropped EXE
                                                      PID:6252
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                    13⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Enumerates system info in registry
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:6372
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe
                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x19c,0x1a0,0x198,0x168,0x194,0x7ff9406b5310,0x7ff9406b5320,0x7ff9406b5330
                                                      14⤵
                                                      • Executes dropped EXE
                                                      PID:6452
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0xf9e2bc,0xf9e2c8,0xf9e2d4
                                                    13⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:6512
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                      14⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Enumerates system info in registry
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:6528
                                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe
                                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x128,0x170,0x1a4,0x124,0x1a8,0x7ff9406b5310,0x7ff9406b5320,0x7ff9406b5330
                                                        15⤵
                                                        • Executes dropped EXE
                                                        PID:6544
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                      14⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Enumerates system info in registry
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:6604
                                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe
                                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x1ac,0x1b0,0x1b4,0x1a8,0x1b8,0x7ff9406b5310,0x7ff9406b5320,0x7ff9406b5330
                                                        15⤵
                                                        • Executes dropped EXE
                                                        PID:6624
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                      14⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Enumerates system info in registry
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:6696
                                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe
                                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x1ac,0x168,0x19c,0x1a8,0x1b0,0x7ff9406b5310,0x7ff9406b5320,0x7ff9406b5330
                                                        15⤵
                                                        • Executes dropped EXE
                                                        PID:6720
                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
                                              10⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Adds Run key to start application
                                              • Checks processor information in registry
                                              • Enumerates system info in registry
                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                              • Suspicious use of SendNotifyMessage
                                              • Suspicious use of WriteProcessMemory
                                              PID:6232
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x10c,0x108,0xf4,0xc0,0xf0,0x7ff9406b5310,0x7ff9406b5320,0x7ff9406b5330
                                                11⤵
                                                • Executes dropped EXE
                                                PID:6260
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1816,i,15384287857299574794,779254273498938113,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2076 /prefetch:3
                                                11⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • System Time Discovery
                                                • Enumerates system info in registry
                                                PID:6924
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1648,i,4163151937870419497,4832064826688929796,262144 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2020 /prefetch:2
                                                11⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Enumerates system info in registry
                                                PID:6960
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2364,i,3172870438176038462,15350543554780441995,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2488 /prefetch:8
                                                11⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Enumerates system info in registry
                                                PID:7072
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1984,i,186775668644147032,3864037618328477836,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3268 /prefetch:8
                                                11⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Enumerates system info in registry
                                                PID:5360
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3216,i,8088723493158878272,4745162398813673720,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3292 /prefetch:8
                                                11⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Enumerates system info in registry
                                                PID:7172
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3220,i,444366768326350787,15299870804522812876,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3312 /prefetch:8
                                                11⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Enumerates system info in registry
                                                PID:7180
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3236,i,8869259710139853654,8372338848549627304,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3332 /prefetch:8
                                                11⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Enumerates system info in registry
                                                PID:7196
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3248,i,14731550295586507813,2011306210894585558,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3352 /prefetch:8
                                                11⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Enumerates system info in registry
                                                PID:7208
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3260,i,7255724401507678476,15374833464687838562,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3372 /prefetch:8
                                                11⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                PID:7248
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3444,i,15844095300671866189,11910756759323517495,2097152 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3728 /prefetch:1
                                                11⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Enumerates system info in registry
                                                PID:7268
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_gx_splash.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_gx_splash.exe" --instance-name=61C8973803226C4D4008DEBC18682105EDAB1556896BB924D0EEB1B6C96AB147
                                                11⤵
                                                • Executes dropped EXE
                                                PID:7868
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4344,i,1917013725389679594,1583934794674674684,2097152 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4416 /prefetch:1
                                                11⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Enumerates system info in registry
                                                PID:8052
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4796,i,7726679878429969133,15424079020896661325,2097152 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4836 /prefetch:2
                                                11⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                PID:8128
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4948,i,795788370407593012,7493431169969446415,2097152 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4968 /prefetch:1
                                                11⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Enumerates system info in registry
                                                PID:8152
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4988,i,2385590414849862668,3281535111962997279,2097152 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5128 /prefetch:1
                                                11⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Enumerates system info in registry
                                                PID:7996
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --asus-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5264,i,12414575205239768438,9967179672219400576,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5328 /prefetch:8
                                                11⤵
                                                • Executes dropped EXE
                                                • Enumerates system info in registry
                                                PID:8172
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --corsair-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5260,i,14849090178435351212,3012389201593556043,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5332 /prefetch:8
                                                11⤵
                                                • Executes dropped EXE
                                                • Enumerates system info in registry
                                                PID:8020
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --logitech-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5268,i,5378419224171178462,1102292802997102446,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5376 /prefetch:8
                                                11⤵
                                                • Executes dropped EXE
                                                • Enumerates system info in registry
                                                PID:8176
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --razer-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5272,i,719991877326134453,17658343598435551362,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5368 /prefetch:8
                                                11⤵
                                                • Executes dropped EXE
                                                • Enumerates system info in registry
                                                PID:8008
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5772,i,18445848405779804298,10008983969227091106,2097152 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=5836 /prefetch:2
                                                11⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Enumerates system info in registry
                                                PID:6024
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6420,i,6518738738721533465,5858467334539998482,2097152 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6440 /prefetch:2
                                                11⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Enumerates system info in registry
                                                PID:5244
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6708,i,2764640291629364794,4541914702743611803,2097152 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6752 /prefetch:2
                                                11⤵
                                                • Checks computer location settings
                                                • Enumerates system info in registry
                                                PID:6716
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6840,i,3241921481543243649,16064588004814003125,2097152 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6868 /prefetch:1
                                                11⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Enumerates system info in registry
                                                PID:6708
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7036,i,3246778892631066614,8048983828038965590,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=6372 /prefetch:8
                                                11⤵
                                                • Executes dropped EXE
                                                • Enumerates system info in registry
                                                PID:2612
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6880,i,1658899391542093929,2333288246063138797,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=6876 /prefetch:8
                                                11⤵
                                                • Executes dropped EXE
                                                • Enumerates system info in registry
                                                PID:7412
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6344,i,11697442872206702673,7148801450176971357,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7336 /prefetch:8
                                                11⤵
                                                • Executes dropped EXE
                                                • Enumerates system info in registry
                                                PID:7436
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7344,i,4531310950134178937,650984629633195792,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7480 /prefetch:8
                                                11⤵
                                                • Executes dropped EXE
                                                • Enumerates system info in registry
                                                PID:5620
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7488,i,11463482429296640773,14168459875660417840,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7624 /prefetch:8
                                                11⤵
                                                • Executes dropped EXE
                                                PID:7500
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7656,i,430663166888797825,15945791841084316275,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=7628 /prefetch:8
                                                11⤵
                                                • Executes dropped EXE
                                                • Enumerates system info in registry
                                                PID:1584
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7768,i,2137144144979087875,13786039831282444410,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=7920 /prefetch:8
                                                11⤵
                                                • Enumerates system info in registry
                                                PID:3884
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8068,i,13913935216830058258,7085268179730108770,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8096 /prefetch:8
                                                11⤵
                                                  PID:2932
                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8076,i,3594029726771365373,1190765816527790864,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8124 /prefetch:8
                                                  11⤵
                                                    PID:7512
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8084,i,6494116092587137017,10387251641354866306,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8144 /prefetch:8
                                                    11⤵
                                                    • Enumerates system info in registry
                                                    PID:7548
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8104,i,13753636874742315655,1479361843250357561,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8180 /prefetch:8
                                                    11⤵
                                                    • Enumerates system info in registry
                                                    PID:4300
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8156,i,17372769020265883217,5292115043349246201,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=8548 /prefetch:8
                                                    11⤵
                                                    • Enumerates system info in registry
                                                    PID:1324
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8808,i,16853460997438241996,8389352591426835704,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=8052 /prefetch:8
                                                    11⤵
                                                      PID:7792
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9472,i,4940734293935224233,8943196425970269283,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=9488 /prefetch:8
                                                      11⤵
                                                      • Enumerates system info in registry
                                                      PID:5364
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9648,i,1411185298479030066,9324341455090780800,524288 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=9640 /prefetch:8
                                                      11⤵
                                                      • Enumerates system info in registry
                                                      PID:7252
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=4972,i,16665666888856224848,10384499596750861195,2097152 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=5584 /prefetch:2
                                                      11⤵
                                                      • Checks computer location settings
                                                      PID:2692
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --pipeid=oauc_pipeF347B60CA73F3F3DA84B31019F4EB851ECFC332513021FC062CC0CA8D8440B54
                                                      11⤵
                                                        PID:7728
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x298,0x29c,0x2a0,0x270,0x278,0x7ff6108938d0,0x7ff6108938dc,0x7ff6108938e8
                                                          12⤵
                                                            PID:4756
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --edition=std-2 --host=https://autoupdate.opera.com/ --installationdatadir="C:\Users\Admin\AppData\Local\Programs\Opera GX" --installdir="C:\Users\Admin\AppData\Local\Programs\Opera GX" --lang=en-US --pipeid --producttype --requesttype=shutdown --version=134.0.5954.67 --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --firstrunver=134.0.5954.67 --firstrunts=1787891826 --consent-info=eyJzdGF0aXN0aWNzX2NvbGxlY3Rpb25fZW5hYmxlZCI6dHJ1ZSwidXNlcl9leHBlcmllbmNlX21ldHJpY3NfcmVwb3J0aW5nX2VuYWJsZWQiOnRydWV9
                                                          11⤵
                                                            PID:1936
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff6108938d0,0x7ff6108938dc,0x7ff6108938e8
                                                              12⤵
                                                                PID:2760
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=9584,i,4339147693496088991,284294846100828172,2097152 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=9528 /prefetch:1
                                                              11⤵
                                                              • Checks computer location settings
                                                              PID:7864
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=8712,i,8052853664527532059,15471041239964826896,2097152 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=9876 /prefetch:2
                                                              11⤵
                                                              • Checks computer location settings
                                                              • Enumerates system info in registry
                                                              PID:7644
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=8632,i,12651952900810575041,9112566201798510501,2097152 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=8832 /prefetch:1
                                                              11⤵
                                                              • Checks computer location settings
                                                              • Enumerates system info in registry
                                                              PID:4144
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=8604,i,13443106934831061140,4595392806728410300,2097152 --field-trial-handle=2024,i,7097458896186711957,17930004504062954532,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,2280764512779944779,18197014774769856683,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=9600 /prefetch:1
                                                              11⤵
                                                              • Checks computer location settings
                                                              • Enumerates system info in registry
                                                              PID:5688
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\installer.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\installer.exe" --fix-taskbar-pins
                                                              11⤵
                                                                PID:5660
                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\installer.exe
                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x28c,0x290,0x294,0x240,0x298,0x7ff7ac12bd88,0x7ff7ac12bd94,0x7ff7ac12bda0
                                                                  12⤵
                                                                    PID:4624
                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161\assistant\Opera_GX_assistant_134.0.5954.44_Setup.exe_sfx.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161\assistant\Opera_GX_assistant_134.0.5954.44_Setup.exe_sfx.exe"
                                                            8⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:7876
                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161\assistant\assistant_installer.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161\assistant\assistant_installer.exe" --version
                                                            8⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:7956
                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161\assistant\assistant_installer.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0xc4cb80,0xc4cb8c,0xc4cb98
                                                              9⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              PID:8000
                                                  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                                                    "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
                                                    4⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:7632
                                                    • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                                                      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
                                                      5⤵
                                                        PID:7736
                                                        • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                                                          "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=windows-1252 -jar C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                                                          6⤵
                                                            PID:1908
                                                            • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\bin\java.exe
                                                              C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\bin\java.exe -Dsun.java2d.uiScale.enabled=false -Xmx1536m -Dfile.encoding=UTF8 -Djava.net.preferIPv4Stack=true --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.desktop/java.awt=ALL-UNNAMED --add-opens=java.desktop/sun.awt.image=ALL-UNNAMED --add-opens=java.desktop/sun.java2d=ALL-UNNAMED --add-opens=java.desktop/java.awt.color=ALL-UNNAMED --add-opens=java.desktop/java.awt.image=ALL-UNNAMED --add-opens=java.desktop/com.apple.eawt=ALL-UNNAMED --add-opens=java.base/java.util.regex=ALL-UNNAMED --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.desktop/java.beans=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.network=ALL-UNNAMED --add-opens=javafx.web/javafx.scene.web=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.event=ALL-UNNAMED -cp C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\annotations-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aopalliance-1.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\arns-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\auth-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-query-protocol-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-xml-protocol-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checker-qual-3.12.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checksums-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checksums-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-compress-1.23.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-io-2.11.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-lang3-3.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-1.1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-api-1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-vfs2-2.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\crt-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\desktop-common-util-1.269-java21.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\DiscordIPC-0.5.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\dnsjava-2.1.8.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\endpoints-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\error_prone_annotations-2.18.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\eventstream-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\failureaccess-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\filters-2.0.235.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\gson-2.13.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guava-31.0.1-jre.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-assistedinject-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-aws-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-aws-eventstream-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-client-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-download-1.269-java21.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpclient5-5.6.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpclient5-fluent-5.6.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpcore5-5.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpcore5-h2-5.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\identity-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\j2objc-annotations-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jackson-annotations-2.13.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jakarta.inject-api-2.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\java-image-scaling-0.8.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javax.annotation-api-1.3.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-api-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-core-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-impl-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jcl-over-slf4j-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-20230227.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-utils-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jsr305-3.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-native-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junrar-0.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\log4j-1.2.17.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-classic-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-core-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\lombok-1.18.30.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-api-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svn-commons-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svnexe-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\metrics-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\MinecraftServerPing-1.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\mockserver-netty-no-dependencies-5.14.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\modpack-dto-2.283.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\picture-bundle-3.73.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\plexus-utils-1.5.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\profiles-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\protocol-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\reactive-streams-1.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regexp-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regions-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\retries-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\retries-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\s3-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\sdk-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\skin-api-1.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\slf4j-api-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\statistics-dto-1.73.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\third-party-jackson-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\tlauncher-resource-1.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\utils-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\utils-lite-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\xz-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\original-TLauncher-2.9374.jar; org.tlauncher.tlauncher.rmo.TLauncher -starterConfig=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\starter.json -requireUpdate=false -currentAppVersion=2.9374 -starterDomainAvailabilityV1=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\domainAvailability.json -country=${country} "-starterJVM=C:\Program Files\Java\jre-1.8\bin\javaw.exe" -starterWorkingDirectory=C:\Users\Admin\Downloads -starterJarFile=C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe -starterFileEncoding=windows-1252 -runVersionWithServer=empty
                                                              7⤵
                                                              • Checks computer location settings
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • System Time Discovery
                                                              • Checks processor information in registry
                                                              PID:8052
                                                              • C:\Windows\System32\Conhost.exe
                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                8⤵
                                                                  PID:2932
                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                  cmd.exe /C "chcp 437 & wmic CPU get NAME"
                                                                  8⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:1956
                                                                  • C:\Windows\system32\chcp.com
                                                                    chcp 437
                                                                    9⤵
                                                                      PID:7004
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic CPU get NAME
                                                                      9⤵
                                                                        PID:8176
                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                      cmd.exe /C "chcp 437 & cmd.exe /c set processor"
                                                                      8⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:7412
                                                                      • C:\Windows\system32\chcp.com
                                                                        chcp 437
                                                                        9⤵
                                                                          PID:5412
                                                                        • C:\Windows\system32\cmd.exe
                                                                          cmd.exe /c set processor
                                                                          9⤵
                                                                          • Executes a command shell one-liner
                                                                          PID:8164
                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                        cmd.exe /C "chcp 437 & dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.tlauncher\logs\tlauncher\dxdiag.txt"
                                                                        8⤵
                                                                        • Executes a command shell one-liner
                                                                        PID:7752
                                                                        • C:\Windows\system32\chcp.com
                                                                          chcp 437
                                                                          9⤵
                                                                            PID:7124
                                                                          • C:\Windows\system32\dxdiag.exe
                                                                            dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.tlauncher\logs\tlauncher\dxdiag.txt
                                                                            9⤵
                                                                            • Drops file in System32 directory
                                                                            • Checks SCSI registry key(s)
                                                                            • Modifies registry class
                                                                            PID:2532
                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                          cmd.exe /C "chcp 437 & wmic qfe get HotFixID"
                                                                          8⤵
                                                                          • Executes a command shell one-liner
                                                                          PID:7068
                                                                          • C:\Windows\system32\chcp.com
                                                                            chcp 437
                                                                            9⤵
                                                                              PID:7012
                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                              wmic qfe get HotFixID
                                                                              9⤵
                                                                                PID:7388
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,7434783670315941322,5485684327574153825,524288 --field-trial-handle=2436,i,7782447178488506495,12514230146837104535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:8
                                                                  2⤵
                                                                    PID:4288
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,15711227469579454026,12728757095126715383,524288 --field-trial-handle=2436,i,7782447178488506495,12514230146837104535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5748 /prefetch:8
                                                                    2⤵
                                                                      PID:2896
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4872,i,5954235902449286094,565844699784598539,524288 --field-trial-handle=2436,i,7782447178488506495,12514230146837104535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5752 /prefetch:8
                                                                      2⤵
                                                                        PID:3508
                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                      1⤵
                                                                        PID:4308
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                        1⤵
                                                                          PID:3460
                                                                        • C:\Windows\SysWOW64\DllHost.exe
                                                                          C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
                                                                          1⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:5136
                                                                        • C:\Windows\system32\wbem\unsecapp.exe
                                                                          C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                          1⤵
                                                                            PID:7580
                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --autostart
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Enumerates system info in registry
                                                                            PID:1976
                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe
                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x18c,0x190,0x188,0x158,0x184,0x7ff9406b5310,0x7ff9406b5320,0x7ff9406b5330
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:1452
                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe7FAE56220944838BCDB933E86AD23A432FE91C0ADA84DF94778C72EE141B2B1F
                                                                            1⤵
                                                                            • Enumerates system info in registry
                                                                            PID:1356
                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x274,0x278,0x27c,0x210,0x280,0x7ff6108938d0,0x7ff6108938dc,0x7ff6108938e8
                                                                              2⤵
                                                                                PID:3932
                                                                            • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                                                                              "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
                                                                              1⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5976
                                                                              • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                                                                                "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
                                                                                2⤵
                                                                                  PID:6140
                                                                              • C:\Windows\System32\GameBarPresenceWriter.exe
                                                                                "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                                                                                1⤵
                                                                                • Network Service Discovery
                                                                                PID:5932
                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                1⤵
                                                                                  PID:2536
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                                                                                  1⤵
                                                                                  • Drops desktop.ini file(s)
                                                                                  • Checks processor information in registry
                                                                                  PID:7964
                                                                                • C:\Windows\System32\svchost.exe
                                                                                  C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
                                                                                  1⤵
                                                                                  • Checks processor information in registry
                                                                                  • Modifies data under HKEY_USERS
                                                                                  PID:6404
                                                                                • C:\Windows\System32\GameBarPresenceWriter.exe
                                                                                  "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                                                                                  1⤵
                                                                                  • Network Service Discovery
                                                                                  PID:4540
                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                  1⤵
                                                                                    PID:5916
                                                                                  • C:\Windows\System32\GameBarPresenceWriter.exe
                                                                                    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                                                                                    1⤵
                                                                                    • Network Service Discovery
                                                                                    PID:5932
                                                                                  • C:\Windows\system32\OpenWith.exe
                                                                                    C:\Windows\system32\OpenWith.exe -Embedding
                                                                                    1⤵
                                                                                      PID:3908
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                                                                                      1⤵
                                                                                      • Checks processor information in registry
                                                                                      • Modifies registry class
                                                                                      PID:7380
                                                                                    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe
                                                                                      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding
                                                                                      1⤵
                                                                                        PID:1692

                                                                                      Network

                                                                                            MITRE ATT&CK Enterprise v16

                                                                                            Reconnaissance

                                                                                            Resource Development

                                                                                            Initial Access

                                                                                            Execution

                                                                                            Command and Scripting Interpreter

                                                                                            1
                                                                                            T1059

                                                                                            Windows Command Shell

                                                                                            1
                                                                                            T1059.003

                                                                                            Persistence

                                                                                            Boot or Logon Autostart Execution

                                                                                            1
                                                                                            T1547

                                                                                            Registry Run Keys / Startup Folder

                                                                                            1
                                                                                            T1547.001

                                                                                            Event Triggered Execution

                                                                                            1
                                                                                            T1546

                                                                                            Component Object Model Hijacking

                                                                                            1
                                                                                            T1546.015

                                                                                            Privilege Escalation

                                                                                            Boot or Logon Autostart Execution

                                                                                            1
                                                                                            T1547

                                                                                            Registry Run Keys / Startup Folder

                                                                                            1
                                                                                            T1547.001

                                                                                            Event Triggered Execution

                                                                                            1
                                                                                            T1546

                                                                                            Component Object Model Hijacking

                                                                                            1
                                                                                            T1546.015

                                                                                            Defense Evasion

                                                                                            Modify Registry

                                                                                            3
                                                                                            T1112

                                                                                            Subvert Trust Controls

                                                                                            1
                                                                                            T1553

                                                                                            Install Root Certificate

                                                                                            1
                                                                                            T1553.004

                                                                                            Credential Access

                                                                                            Credentials from Password Stores

                                                                                            1
                                                                                            T1555

                                                                                            Credentials from Web Browsers

                                                                                            1
                                                                                            T1555.003

                                                                                            Unsecured Credentials

                                                                                            1
                                                                                            T1552

                                                                                            Credentials In Files

                                                                                            1
                                                                                            T1552.001

                                                                                            Discovery

                                                                                            Browser Information Discovery

                                                                                            1
                                                                                            T1217

                                                                                            Network Service Discovery

                                                                                            1
                                                                                            T1046

                                                                                            Peripheral Device Discovery

                                                                                            2
                                                                                            T1120

                                                                                            Query Registry

                                                                                            7
                                                                                            T1012

                                                                                            System Information Discovery

                                                                                            6
                                                                                            T1082

                                                                                            System Location Discovery

                                                                                            1
                                                                                            T1614

                                                                                            System Language Discovery

                                                                                            1
                                                                                            T1614.001

                                                                                            System Network Configuration Discovery

                                                                                            1
                                                                                            T1016

                                                                                            Internet Connection Discovery

                                                                                            1
                                                                                            T1016.001

                                                                                            System Time Discovery

                                                                                            1
                                                                                            T1124

                                                                                            Lateral Movement

                                                                                            Collection

                                                                                            Data from Local System

                                                                                            1
                                                                                            T1005

                                                                                            Command and Control

                                                                                            Exfiltration

                                                                                            Impact

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                            • Size 471B
                                                                                            • SHA256 d4f2c4655ba0ef80c1ea09576fa04bb8f95b3d892c9a6cea30ec76fd5dfed2ff
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                            • Size 416B
                                                                                            • SHA256 69b5d6981ddf82b2ce54acd8dd51992ec28ab18fd794c20c2ac409a5f908f98c
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            BookmarkMergedSurfaceOrdering
                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                            • Size 6B
                                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            BrowsingTopicsState
                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                            • Size 414B
                                                                                            • SHA256 6275fa23203092cb3480b3dfb8f3ee707f60f9540a90f7e67796bb6d9fe1f666
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            the-real-index
                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                            • Size 888B
                                                                                            • SHA256 9121b438dda4a28b17eb05cf39e7651ccb59d122b0255d9693fcd2976545b45e
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            data_1
                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
                                                                                            • Size 264KB
                                                                                            • SHA256 e31b82aeb978a9faff848e9b256571386483ec62ba24217afa35e69ddfa931a9
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Network Persistent State
                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                            • Size 7KB
                                                                                            • SHA256 cc379d24c356995e4c5b083d71bba2407a1daaa9e38ff69d422d9b988c0bdc6b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            SCT Auditing Pending Reports
                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                            • Size 2B
                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            TransportSecurity
                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                            • Size 1KB
                                                                                            • SHA256 aa489aa2d18a7936b722f115b64e423d934f1120fe9ec176c4ec5e1cc4d6689d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            Preferences
                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                            • Size 13KB
                                                                                            • SHA256 9041a0d94fd40eeb740dcb9584d49ea66dc8e3f75b30517f99acb7eec3bf5984
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Preferences
                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                            • Size 13KB
                                                                                            • SHA256 e9fb68e1d909cfa90783389dbb6139e206809e4f60dc56a67415bd6ade68c9d1
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Secure Preferences
                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                            • Size 17KB
                                                                                            • SHA256 3f9b2ff6733d6ea176b7f87b97bfc00f43ce5ae2fc7db0bf43e5673b611d2981
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            the-real-index
                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                            • Size 120B
                                                                                            • SHA256 2037c3946587728bb0df838d63ea7de5fd8dacdc099c68d50dcb6ad421934a2c
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            the-real-index~RFe592958.TMP
                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592958.TMP
                                                                                            • Size 96B
                                                                                            • SHA256 d1c7704b453ee11bd1f9ff9604b2755907c9c1d627d65ebadc78b770288ac642
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            the-real-index
                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                            • Size 96B
                                                                                            • SHA256 4b445f9bfc20bfee45091d0d3a67f3a059ad76b7555198b4ba890737d04ad232
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            Local State
                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                            • Size 241KB
                                                                                            • SHA256 4696644b2acdf59d283d8d29b3bf97eb9cfba0d97ca1e6dc594db99a827f627e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Local State
                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                            • Size 241KB
                                                                                            • SHA256 cee2895441bcc2cf132597006cb2e3afa0eade2db69dd022dcdc699df5d5b15f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Local State
                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                            • Size 241KB
                                                                                            • SHA256 ea6672ccfab897c39cbec72e43d7b3c28f723d266b561728cde5b45b210f735e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Local State
                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                            • Size 115KB
                                                                                            • SHA256 e4034ec02fa579d56637e4525918221ee10e1c0b8e880b35d49b2b7d7a0e0c5e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            134.0.5954.67.manifest
                                                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\134.0.5954.67.manifest
                                                                                            • Size 225B
                                                                                            • SHA256 0e1160adc59a574120ff7a87c060568a79408ae79ca837b71edc69bc210310d6
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            150x150Logo.scale-100.png
                                                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\Assets\150x150Logo.scale-100.png
                                                                                            • Size 2KB
                                                                                            • SHA256 9635c074c9d8edde0baf3111dbd7db49cbdc370c4f729c80ac382949f32be526
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            150x150Logo.scale-100_contrast-white.png
                                                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\Assets\150x150Logo.scale-100_contrast-white.png
                                                                                            • Size 1KB
                                                                                            • SHA256 28ce8fcb22080ce1f69346cb0720bbe5662959e413426f00062b706013da8c28
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            150x150Logo.scale-140.png
                                                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\Assets\150x150Logo.scale-140.png
                                                                                            • Size 3KB
                                                                                            • SHA256 a36a13a5d5e3d39e3018ccc5f8859944c87256f8be24a3c08a6bf3cb06a26804
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            150x150Logo.scale-140_contrast-white.png
                                                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\Assets\150x150Logo.scale-140_contrast-white.png
                                                                                            • Size 2KB
                                                                                            • SHA256 0bd63fe653885286e180fbdf6d1dadc66af242b8ed6bd1d03d8c5eccc20e91d7
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            installer.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\installer.exe
                                                                                            • Size 9.1MB
                                                                                            • SHA256 4a2f8a2712b23ef4eb33beea0f223e760c077d412b7483c4d89dd8ce37d5609a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            +JXF11747700740986522786.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\+JXF11747700740986522786.tmp
                                                                                            • Size 424KB
                                                                                            • SHA256 83ff53f599acefc11f5cf63fd0516d4db72aacf7f0125a5f79c9ff222cbf9dd7
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            +JXF12846146616285186626.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\+JXF12846146616285186626.tmp
                                                                                            • Size 141KB
                                                                                            • SHA256 b2efabca5ea4bc56eea829713706b5cd0788b82aca153bd4adde9b1573933b4f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            +JXF12982398645832327073.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\+JXF12982398645832327073.tmp
                                                                                            • Size 477KB
                                                                                            • SHA256 a4ece920f221b78d43b550d615c5934db162b64a331ffa663a85199e74ef2e6b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            +JXF15567018668370377932.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\+JXF15567018668370377932.tmp
                                                                                            • Size 132KB
                                                                                            • SHA256 9287925cae90ac480804094ff0876832065e2db116470da1f524d79ed9c18b70
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            +JXF3808178517671735751.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\+JXF3808178517671735751.tmp
                                                                                            • Size 156KB
                                                                                            • SHA256 7149f8f1d8b0386ab74427c78d660e211c572ffd901897f86475319d28248083
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Opera GX Browser.lnk
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161\Opera GX Browser.lnk
                                                                                            • Size 1KB
                                                                                            • SHA256 56857c70e3bb69865ed69c8f114be5c424340f2aecf8c588e90dd59de60ac290
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            additional_file0.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161\additional_file0.tmp
                                                                                            • Size 2.8MB
                                                                                            • SHA256 70f1b1cbe5162fd8842c441779ef4d59de6b182d1448fc6285c6a73ae3033fc4
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            assistant_installer.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161\assistant\assistant_installer.exe
                                                                                            • Size 2.4MB
                                                                                            • SHA256 c5eef147beda944c8bff63591165b4c49e556d2c45c6ea9b9f1d9e16f180621e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            dbgcore.DLL
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161\assistant\dbgcore.DLL
                                                                                            • Size 196KB
                                                                                            • SHA256 856a7e6aacf1934324f08dc42b4b37cb20886d933cc0c57283c8425f9ebedbdd
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            dbghelp.dll
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161\assistant\dbghelp.dll
                                                                                            • Size 1.8MB
                                                                                            • SHA256 8f880333398382fea1efa73751f4b16d8204a60cc13aefc8c4223b8086eccd81
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            installer_prefs_include.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161\installer_prefs_include.json
                                                                                            • Size 227B
                                                                                            • SHA256 97331f17409895395d817dd6dab7119ff107665a9f866a3c2926bfa9ada6b1b7
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            installer_prefs_include.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161\installer_prefs_include.json
                                                                                            • Size 242B
                                                                                            • SHA256 40ea1fbf69784552a6aca6f03f95b7ec4c38332d39c88322835c70b661d643dd
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            installer_prefs_include.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\64c8df13-9f57-4f20-9a76-3fde272f33d0 Opera GX Installer Temp\opera_package_202608280536161\installer_prefs_include.json
                                                                                            • Size 933B
                                                                                            • SHA256 00780246f020ad32b825368a8f14b8297be2433e3afc20d89faf65eb2958044c
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            installer.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\7zSC637FB79\installer.exe
                                                                                            • Size 9.1MB
                                                                                            • SHA256 ce0afbd8f8cd1a36958b3d0bc8aa78e8c99c7861bab067a67821f77728be608d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            200.ico
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
                                                                                            • Size 116KB
                                                                                            • SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            BrowserInstaller.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe
                                                                                            • Size 3.7MB
                                                                                            • SHA256 e20f18d8c5d3621a81d35fe43d759ddb148e35d1856a94fbe95dfbec93127a10
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            IRIMG1.BMP
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP
                                                                                            • Size 12KB
                                                                                            • SHA256 1d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            IRIMG1.PNG
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG
                                                                                            • Size 45KB
                                                                                            • SHA256 a42ab4d62c5a5286202df15f9ad32b22396d5d12c7a4db8c5a2c98f90160ade1
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            IRIMG10.PNG
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG10.PNG
                                                                                            • Size 206B
                                                                                            • SHA256 348e3f3544cca4c9ca2af323fa8b3453a70ea421c82b331681dc1d4ef74921f3
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            IRIMG13.PNG
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG13.PNG
                                                                                            • Size 41KB
                                                                                            • SHA256 1708790d5496b9cc325cc0249cfa272aac3c3738188fc41eef83e8592de247ff
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            IRIMG14.PNG
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG14.PNG
                                                                                            • Size 43KB
                                                                                            • SHA256 6528bb11becf79c17c77a9c6624b82074b9dd6d3e932852c8fe1da22a57854aa
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            IRIMG15.PNG
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG15.PNG
                                                                                            • Size 644B
                                                                                            • SHA256 207bd7ad2eb7f48a2a1be1253363fa120ae79e25eacbd37d6b9be52d2128bfdd
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            IRIMG17.PNG
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG17.PNG
                                                                                            • Size 40KB
                                                                                            • SHA256 06fad383e3506eb1be52877bee839b833de157a2601af1c443ef1244a92f5d8f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            IRIMG2.BMP
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP
                                                                                            • Size 12KB
                                                                                            • SHA256 9c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            IRIMG3.BMP
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP
                                                                                            • Size 12KB
                                                                                            • SHA256 4c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            IRIMG3.PNG
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG
                                                                                            • Size 475B
                                                                                            • SHA256 d339d7a5fcaff72292150f3c7db87a73caa396e23224b570e053c8bb96a3a897
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            IRIMG4.BMP
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG4.BMP
                                                                                            • Size 451KB
                                                                                            • SHA256 64da5bd044908b2c3a725c5a55edec1644be498f41ea05d42a6ae8cd797f1d80
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            IRIMG4.PNG
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG4.PNG
                                                                                            • Size 368B
                                                                                            • SHA256 3207283d0abc0dd36c0991b40a738247394bbc92e5696eb790a5c888a9f28106
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            IRIMG9.PNG
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG9.PNG
                                                                                            • Size 438B
                                                                                            • SHA256 d16a8eaf8f979e45bacbbd8ef14afe482d74e926dff2e87e569342874ba34145
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            IRZip.lmd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
                                                                                            • Size 400KB
                                                                                            • SHA256 3a6794c90d69383bd76098992cb512ae343cb2e1a3680dd4794e49895472b429
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Wow64.lmd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
                                                                                            • Size 252KB
                                                                                            • SHA256 27b48727237cd0f8a1205e01e5c93cbe6c7a2f3938faf8d8daa5191094c347a5
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            irsetup.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                                                                            • Size 1.8MB
                                                                                            • SHA256 96070b2d82b6bffd54719f9753909be5f5151edbd5b37b26f50dea2e995ea430
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            lua5.3.dll
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
                                                                                            • Size 395KB
                                                                                            • SHA256 eef58c3dae331da03872b973230aa56b40e34035035cca5b468eda0c40daa819
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            irsetup.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                                                                            • Size 1.7MB
                                                                                            • SHA256 ea04ee2883ca5dcb461ea894a4e2def7d0c89f11d9f06f3bae020f6a25e7b75d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            lua5.3.dll
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.3.dll
                                                                                            • Size 395KB
                                                                                            • SHA256 0e43d22649d6b2ecbac9915dc6498fe1f41777dd33147d962b30dad0d5e76ab3
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            imageio538305452095371127.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\imageio538305452095371127.tmp
                                                                                            • Size 231B
                                                                                            • SHA256 3aa536e4a0eaf52249c31ad4c033cf59af476d71682d0a14656059220f6fd217
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            imageio6080259250519455690.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\imageio6080259250519455690.tmp
                                                                                            • Size 239B
                                                                                            • SHA256 7e20b79a691e10fcd0d78f70723384a4a8d574310adc507d6babbe87ee4f9af5
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            imageio64708072006490006.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\imageio64708072006490006.tmp
                                                                                            • Size 5KB
                                                                                            • SHA256 ab54464948dec30d9d13e624bd5e5d0d59ef641b9efdab4eb869fb255a54e357
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            opera-installer-bro.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                                                                            • Size 3.9MB
                                                                                            • SHA256 eaf93d4db3e00977a44a5ac2c9899f6422c1dbfb36e4c006f8eddb8bb1ea7559
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            setuparguments.ini
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
                                                                                            • Size 800B
                                                                                            • SHA256 9794700d1b87d8e0719330590d35467aceaca3fc239d4e1ac23244f568da8cd9
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            TLauncher.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                                                                                            • Size 9.2MB
                                                                                            • SHA256 8cdc16a8f34f99dc85273838350ae9a9a840de8c6dda3c045c5514520842dd78
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            d7caa0e3aa5eb656c51817ae4bfbf3c4d72cdaad.tlauncherdownload
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\assets\objects\d7\d7caa0e3aa5eb656c51817ae4bfbf3c4d72cdaad.tlauncherdownload
                                                                                            • Size 98KB
                                                                                            • SHA256 65388145333f6ceffe2be67790183a77d45b97236248ac1eab3befe6a17979d7
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            net.properties
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\net.properties
                                                                                            • Size 7KB
                                                                                            • SHA256 594bc40230a0bd7c441fe069989d66e534a6bae2ee5910f9f4bf64e59b583256
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            README.txt
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\security\policy\README.txt
                                                                                            • Size 2KB
                                                                                            • SHA256 6da0747334b0fea7592fd92614b2bbc8b126535e129b1fee483774d914e98eb5
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            default_US_export.policy.tlauncherdownload
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\security\policy\limited\default_US_export.policy.tlauncherdownload
                                                                                            • Size 146B
                                                                                            • SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            default_local.policy
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\security\policy\limited\default_local.policy
                                                                                            • Size 647B
                                                                                            • SHA256 2b2627548e61316150d47ffc3e6cad465ca05b3cccd4785eb7d21aa7baa0f441
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            exempt_local.policy
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\security\policy\limited\exempt_local.policy
                                                                                            • Size 566B
                                                                                            • SHA256 8c3d7648abcd95a272ce12db870082937f4d7f6878d730d83cb7fbb31eb8b2c9
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            default_local.policy
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\security\policy\unlimited\default_local.policy
                                                                                            • Size 193B
                                                                                            • SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            sound.properties
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\sound.properties
                                                                                            • Size 1KB
                                                                                            • SHA256 299c2360b6155eb28990ec49cd21753f97e43442fe8fab03e04f3e213df43a66
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ADDITIONAL_LICENSE_INFO
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\ADDITIONAL_LICENSE_INFO
                                                                                            • Size 2KB
                                                                                            • SHA256 a69bce275ba7a3570af6579cb0f55682cd75fedfcd49e0e8e9022270c447c916
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            LICENSE
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\LICENSE
                                                                                            • Size 18KB
                                                                                            • SHA256 4b9abebc4338048a7c2dc184e9f800deb349366bdf28eb23c2677a77b4c87726
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            aes.md
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\aes.md
                                                                                            • Size 1KB
                                                                                            • SHA256 45c6d4da48325edfbff3dcf71c704e504c057904435ed23c6d57046d551eb69d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            c-libutl.md
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\c-libutl.md
                                                                                            • Size 1KB
                                                                                            • SHA256 bef40679922d6fdfb7e4ddb223ad6722300f6054ba737bbf6188d60fcec517f9
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            siphash.md
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\siphash.md
                                                                                            • Size 8KB
                                                                                            • SHA256 5a792b5a74ad2a5f3d6a7ad8b7a841116e58a772c18bc6e392320a365b222c76
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            wepoll.md
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\wepoll.md
                                                                                            • Size 1KB
                                                                                            • SHA256 3ac2992770080453b98c42afa807ba4b2c1738ef756b92a55c645f55e7df48f0
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            zlib.md
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\zlib.md
                                                                                            • Size 1010B
                                                                                            • SHA256 809b62ba648e02302f7d9ea6b6886c10d5253ac86ad528038a50c73eada5fce2
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ADDITIONAL_LICENSE_INFO.tlauncherdownload
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.desktop\ADDITIONAL_LICENSE_INFO.tlauncherdownload
                                                                                            • Size 48B
                                                                                            • SHA256 d255311b0a181e243de326d111502a8b1dc7277b534a295a8340ab5230e74c83
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            ASSEMBLY_EXCEPTION.tlauncherdownload
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.desktop\ASSEMBLY_EXCEPTION.tlauncherdownload
                                                                                            • Size 43B
                                                                                            • SHA256 7901499314e881a978d80a31970f0daec92d4995f3305e31fb53c38d9cc6ec3b
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            LICENSE.tlauncherdownload
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.desktop\LICENSE.tlauncherdownload
                                                                                            • Size 32B
                                                                                            • SHA256 d60635c89c9f352ae1e66ef414344f290f5b5f7ce5c23d9633d41fde0909df80
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            colorimaging.md
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.desktop\colorimaging.md
                                                                                            • Size 167B
                                                                                            • SHA256 04d61e3e8e71dd452ebe52008af5378d9f6640d14578aeb515dc5375973b0189
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            harfbuzz.md
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.desktop\harfbuzz.md
                                                                                            • Size 3KB
                                                                                            • SHA256 b3f327a8b36d56beb152b3fd1bb5a7f245362cbea123ebbc68f8907f741b552a
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            jpeg.md
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.desktop\jpeg.md
                                                                                            • Size 3KB
                                                                                            • SHA256 c1dfb9719a71ad9f861f8728550542d681e25c8ef40e6393606e6e2a0c1d653a
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            mesa3d.md
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.desktop\mesa3d.md
                                                                                            • Size 5KB
                                                                                            • SHA256 63f4e6f75caebbccb95d903fb43e46ac7111b3624d0a34f146b276d7d9e7b152
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            santuario.md
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.xml.crypto\santuario.md
                                                                                            • Size 11KB
                                                                                            • SHA256 d08690d25f660f145c73365d260ed522cd0aace8a0e1396706551b7a1ae8c9a3
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            dom.md
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.xml\dom.md
                                                                                            • Size 3KB
                                                                                            • SHA256 6686e8877667584a3a7c07344baadca1a03e29f677162d87c3c0811e990d1148
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            jcup.md
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.xml\jcup.md
                                                                                            • Size 1KB
                                                                                            • SHA256 8d5dcfdf50455a3c34c753a98f21e953248af200415a9084e3f102cb6c43b8bf
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            xalan.md
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.xml\xalan.md
                                                                                            • Size 13KB
                                                                                            • SHA256 02bd013fc3f438dbb8fa41fa57888177e015efa6431d37fce6e794c6f353a6a1
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            xerces.md
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.xml\xerces.md
                                                                                            • Size 11KB
                                                                                            • SHA256 4a6bf6b367193ee68681cb2d9fed30ffc5d62dd2d477bd62e0271707d71b3244
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            pkcs11cryptotoken.md
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\jdk.crypto.cryptoki\pkcs11cryptotoken.md
                                                                                            • Size 3KB
                                                                                            • SHA256 1f36ff1342a581142c858f90064e20633d43529ac82adb85345bd902a14e18b2
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            pkcs11wrapper.md
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\jdk.crypto.cryptoki\pkcs11wrapper.md
                                                                                            • Size 2KB
                                                                                            • SHA256 371974b1fca3744a3892c7ee1fcc593b8b4281fc218f4cafd2f709e9df5fd81d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            fontconfig.bfc
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\lib\fontconfig.bfc
                                                                                            • Size 4KB
                                                                                            • SHA256 c7e2e76b908cb6330823e698889943c162e9861a4575501cbb59c9b830158ab0
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            jvm.cfg
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\lib\jvm.cfg
                                                                                            • Size 29B
                                                                                            • SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            uninstall.xml
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                                                                            • Size 21KB
                                                                                            • SHA256 7ec6670514d57789b8ea57f6bd86364e35ad2400b7a3cd564999ee7d0c4facbd
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            version_manifest.json
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_launchermeta.mojang.com\mc\game\version_manifest.json
                                                                                            • Size 202KB
                                                                                            • SHA256 8b928721cee0f732d6f032cf3b55837c29ba77cf225cb1ff38ad20de1b7ebe6c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            32.json
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_piston-meta.mojang.com\v1\packages\0a7b601915914596801099f0522ad169a995b010\32.json
                                                                                            • Size 572KB
                                                                                            • SHA256 7bfe796463dbe4dcad6c858a5e16a838e1a5754e7dc20798ba9d622c0d0ddc94
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            manifest.json
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_piston-meta.mojang.com\v1\packages\b374544c680d965fb5535977d7cb04c6befe1930\manifest.json
                                                                                            • Size 149KB
                                                                                            • SHA256 fcac80eeabd7f68b10136286493f633d043e5804ff4fa1692e654edd129c5853
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            26.2.json
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_piston-meta.mojang.com\v1\packages\f9e9e12c8b96ea9e04b7f87e36583a6ba0e2e9e6\26.2.json
                                                                                            • Size 50KB
                                                                                            • SHA256 c734852dc266210b4f12f3938afc619f3d5da249b4817532680bd69ac577424c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            inner_servers-1.3.json
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\configs\inner_servers-1.3.json
                                                                                            • Size 7KB
                                                                                            • SHA256 e06b1fcf83f256e03e6f8fd96724f3d20889459f071d08a9de3d33616faa3e56
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            index_en.html
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\configs_v1\pages\index_en.html
                                                                                            • Size 50KB
                                                                                            • SHA256 4261662545dde81f1b7b0b8746557c76e349c6d08c95e71ef294ee6b2794d090
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            libraries-1.7.json
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\libraries\org\tlauncher\authlib\libraries-1.7.json
                                                                                            • Size 377KB
                                                                                            • SHA256 0a37d481b94fe7fb9fc60162c22038690c7d67eab09b0b2bfa3445dd01b23710
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            additional_assets-1.1.json
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\versions\new5\additional_assets-1.1.json
                                                                                            • Size 190KB
                                                                                            • SHA256 12ea0578ab812f6e6730ea5b23e7f8bfcbaec59e801b8699abc1e773a3b7476b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            version_manifest.json
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\versions\new5\skin\versions\version_manifest.json
                                                                                            • Size 12KB
                                                                                            • SHA256 e5a04128c61d6c23b527b4914f3cacb711a6691d2eab89813f7f2f5a9d34069f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            version_manifest.json
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\versions\new5\version_manifest.json
                                                                                            • Size 48KB
                                                                                            • SHA256 f39279fac3a1001f213d3bdafcffac010e2cc7bda85abf2415c63955e5b834ee
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            additional_hot_servers-1.0.json
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\lch\additional_hot_servers-1.0.json
                                                                                            • Size 2KB
                                                                                            • SHA256 04f57153be7374c05f9e83de9b122a4f0b8d85d7d65a59d756b58bd84404e0f1
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            hot_servers-1.0.json
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\lch\servers\hot_servers-1.0.json
                                                                                            • Size 50KB
                                                                                            • SHA256 f946a5f6e4d7991f1071ae42f8ad8529c2fb9dd5aa97596f9dbf241df33d16a8
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            java_configuration.json
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_rescl.tl.vg\b\jvm\java_configuration.json
                                                                                            • Size 13KB
                                                                                            • SHA256 b490908c9bda7f4ed5220145dee8dd1ee9ad92a210080adec3c183b0f0a50a8b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            dependencies.json
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9374\dependencies.json
                                                                                            • Size 25KB
                                                                                            • SHA256 76fceb12658369b0d28f14dc35feaae204e36983c6d759c6c7665640547478be
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            resources.json
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9374\resources.json
                                                                                            • Size 17KB
                                                                                            • SHA256 9cd7a802791beed588677cc4b578883263333da42660c6f87add35473ce56b96
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            appConfig.json
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\appConfig.json
                                                                                            • Size 4KB
                                                                                            • SHA256 f1098290548cfee07c581d7886882f78ecb511def9d6edb2eeb3f1bc7aa5d033
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            javaConfig21.json
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\javaConfig21.json
                                                                                            • Size 3KB
                                                                                            • SHA256 4e677c3608065a9a12f97bededc27fd440711f94288012207645df37f516d699
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            starter-core-1.268-v6.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\update\lch\starter-core-1.268-v6.exe
                                                                                            • Size 9.2MB
                                                                                            • SHA256 f0cb809918c2bf85a8eef2bcbd35218e75426b4e5698ca1cca50acf3e5a714ce
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            COPYRIGHT
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\java.logging\COPYRIGHT
                                                                                            • Size 35B
                                                                                            • SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            LICENSE
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\java.logging\LICENSE
                                                                                            • Size 33B
                                                                                            • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            ADDITIONAL_LICENSE_INFO
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\javafx.web\ADDITIONAL_LICENSE_INFO
                                                                                            • Size 51B
                                                                                            • SHA256 0a256a7133bd2146482018ba6204a4ecc75836c139c8792da53536a9b67071d4
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ASSEMBLY_EXCEPTION
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\javafx.web\ASSEMBLY_EXCEPTION
                                                                                            • Size 46B
                                                                                            • SHA256 a4b7ad48df36316ddd7d47fcecc1d7a2c59cbfe22728930220ef63517fd58cb0
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            LICENSE
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\javafx.web\LICENSE
                                                                                            • Size 35B
                                                                                            • SHA256 01a4ebd2a3b2671d913582f1241a176a13e9be98f4e3d5f2f04813e122b88105
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            tlauncher-2.0.properties
                                                                                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\tlauncher-2.0.properties
                                                                                            • Size 1KB
                                                                                            • SHA256 fe6a5b9cf8a96c1c7376c190dd83633eac54080585e2d91f024fb49d8af75d0d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            3c40a806-f089-430b-bded-168d66f7276a.tmp
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\3c40a806-f089-430b-bded-168d66f7276a.tmp
                                                                                            • Size 151B
                                                                                            • SHA256 794fa246238fda4145e8cc4a081877e3395b773595ddf107421ea5365134ea35
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            settings.dat
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
                                                                                            • Size 40B
                                                                                            • SHA256 3eaac09f111f762ba5ca5c2c30eaa99057e3f463339222554d8152354a432dc1
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            06c31183-5b78-42c5-a458-8581373be0f2.tmp
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\06c31183-5b78-42c5-a458-8581373be0f2.tmp
                                                                                            • Size 412B
                                                                                            • SHA256 3249a51835ae564991488ae1cabc4058ed07be0247d9dfcf323fb60fd7041dd3
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            0d610d6d-83d2-43a4-9c9c-5ab074accfc4.tmp
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\0d610d6d-83d2-43a4-9c9c-5ab074accfc4.tmp
                                                                                            • Size 162KB
                                                                                            • SHA256 5903c920e584fc5f1e918bd641bf58fd56e8cb20bb68269892a4984ea7538621
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            6a303d0b-4363-4b88-b8c5-4afc59d48ed9.tmp
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\6a303d0b-4363-4b88-b8c5-4afc59d48ed9.tmp
                                                                                            • Size 14KB
                                                                                            • SHA256 69086cde387a0c04800fa1198134f4c31089bcf687a6964be20bef2411df9899
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            3cb0aa44-3fe4-4eec-aff9-cd4c609f0f4e.tmp
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\3cb0aa44-3fe4-4eec-aff9-cd4c609f0f4e.tmp
                                                                                            • Size 48B
                                                                                            • SHA256 4d8b1c519392063876a6f18b1445157bd0fdee69881ef9c16fb66ad973de1b50
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            the-real-index
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
                                                                                            • Size 456B
                                                                                            • SHA256 2e08276d289e4eef7b0468ca9323d75e4c729a620909eb7e08cd85594e50d9ac
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            MANIFEST-000001
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extension Rules\MANIFEST-000001
                                                                                            • Size 41B
                                                                                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            Preferences
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences
                                                                                            • Size 15KB
                                                                                            • SHA256 386c03a72d1358b14a34dc0ef696397f856149ab4863634bbab4826ea4901a18
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            40229962-a72b-4842-9cad-50a8640480fb.tmp
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\40229962-a72b-4842-9cad-50a8640480fb.tmp
                                                                                            • Size 72B
                                                                                            • SHA256 f098768d752c991e3e0b973e7420c159fa10bd902d8b3667f91b53d41a16adc2
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            the-real-index
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                            • Size 48B
                                                                                            • SHA256 141e3a0be55a54c5f1761e796c2b2e0b5644ad0cb953f9ae4e37db036a88e5c1
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            CURRENT
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Site Characteristics Database\CURRENT
                                                                                            • Size 16B
                                                                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            e5cdcaad-5325-44b4-9017-921f143e2a79.tmp
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\e5cdcaad-5325-44b4-9017-921f143e2a79.tmp
                                                                                            • Size 381B
                                                                                            • SHA256 a7a839ac7613357a15040e5b7d36e6a1d3280083589477ec4172b114cf90d8bf
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 605B
                                                                                            • SHA256 6696ace576be5d100eafe3ddda09bc95c44dbf4d0aedb47a084e4c1918f5fd3e
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 1KB
                                                                                            • SHA256 58e541b1518601d57064bde8eb8f8d3b3529dec49216d16db033ea6a5b3a5ece
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 2KB
                                                                                            • SHA256 de5c67bb582abd9106c3a4bb9343211ea683316e3fbc5e3a609f100e7c71e809
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 2KB
                                                                                            • SHA256 9c7d04cd6bf69770defc5560f961a492581f2231c59c25fd3f18bce5ed00b2de
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 8KB
                                                                                            • SHA256 5a83ed52e1b46976c6916db0c218c991c96ab3c5b6886521deb7d2f754d79815
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 8KB
                                                                                            • SHA256 5a57b82a44ba22d208cc1e1248fa8c6f306aed66a312a0cb685323181b875fa8
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 8KB
                                                                                            • SHA256 09e34e84ebeb2087dc4b32d0eeda32eddcd0f1c3258adb3d3c5f5aa513e91a0d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 8KB
                                                                                            • SHA256 61bc98f2bc2daf0bc4dbaa766a4b30be5efe2069a965dd3965114e46f06c907c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 493B
                                                                                            • SHA256 da4a9926730da3001b2bfead63650d8ce9ac0317e75243e0473edf2960fcc01f
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 733B
                                                                                            • SHA256 8ad02e7fb02c4440750ea1fd3e17490aa69dfd14ab6b59dbdb6a96ab71d4659d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 909B
                                                                                            • SHA256 ed600d37d8498c5781e461029f5b03e8fbe27e6c1edbad82cf7c3ebca3877f3f
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 1KB
                                                                                            • SHA256 135da4f0f9c4c75a4b8bf7da200cdb86aa613daeffeb053e8873766463c37e49
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 1KB
                                                                                            • SHA256 6b586984ead5e77c1fe4f6199dc90b9440138dd085e8b13c6290bfd39b20c8e8
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 1KB
                                                                                            • SHA256 b45bfd0653fd525f5ddaa7dcdeff0e2f72e4aa4e6da1b94aa3dfbb3621a0bf16
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 1KB
                                                                                            • SHA256 026291df247c9cef60fe764445345e2162ddb55b438bedb7218bde90f60c6180
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 1KB
                                                                                            • SHA256 3a8c22d4685d7e3f5c42e0854b58c8eaa4b85ca5293cbec3ddf537afe2b221d0
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 1KB
                                                                                            • SHA256 79e3af8b197312cff7eac9501aec27aaa34dc1cba5e9ec19236ced8ace562e5f
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 1KB
                                                                                            • SHA256 b39f337f2d09c84760d840690c7ef28c5daa03c78a756e137e92a7239afaef5f
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 1KB
                                                                                            • SHA256 88c9450f40c2677f63880ea747ea289cbf863d1f416b419d92310f148cc58de7
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 2KB
                                                                                            • SHA256 27265bf78782810fed538209b9908de11dc8e00d1fb34801e6ea7cef3a92c1dc
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 2KB
                                                                                            • SHA256 6f1727e48e18e65ec95ae6c7114002df31a0b139b70b7c840ccf6a4b647a9266
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 2KB
                                                                                            • SHA256 7643de122a4895a707f76d6b46bdb95d1f20448d021533dbe8e8a8178d8d7954
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 2KB
                                                                                            • SHA256 559ca5fdf8243820964dc3db1c77cc090b4b1668382580f454df969fc18c6fc9
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 2KB
                                                                                            • SHA256 24497117d251f0df59b35b5826e1f53464dd5b3a1257eac6cd45b59a878283f3
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 8KB
                                                                                            • SHA256 1c824c0c9ee0abeac2e75e30e62d5336d74f5fc17ac1d42d90abeaf0ec0997eb
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 9KB
                                                                                            • SHA256 187b6fb3f257b2a6e015a4eb703d12df12a1e4df6010b14e19c1d7150fcfa97d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 8KB
                                                                                            • SHA256 21f6123f782b8737d6d2d742d6c6da36f7d7fbd779f439c93083d1ccfc643a20
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 8KB
                                                                                            • SHA256 3d46102665030292008b1d4ffe3f74a6aa737ce709ec9ab4515cb95f3eb3f0f5
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 9KB
                                                                                            • SHA256 7dc01b273605088e8ed898ff537c420ad6e127e87d8222a53eb04431564fe898
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 9KB
                                                                                            • SHA256 b175ba0d6452944d4c98a878440546d88ec407a716218cd07560154e2bc65f4d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 9KB
                                                                                            • SHA256 b56fcfc0ca5ef4ba1a02f0e5534c14022d3de7102a4f8df7d1217e2bae90b50e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 9KB
                                                                                            • SHA256 eafc121be01d53df48143f912b7232b8972eb0357d25c811d63afd88620dfa19
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 10KB
                                                                                            • SHA256 4e654376d4ded45bdbaeb58b2bb24e32f7b484f7a5e8bfefc4ae315d9568bac4
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 8KB
                                                                                            • SHA256 55e974b47aa224b2eb4e57d218d02f1e091f14d73058cb3ed2e603a61e3e6105
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 9KB
                                                                                            • SHA256 69cf9c9c8252a817a04618bc17f5260c2254f6e66477ac719b4506768a002924
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 9KB
                                                                                            • SHA256 bc13e91672ba7740bd12fd81671290836d4300af2737661001fb3b13820e0f8b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 9KB
                                                                                            • SHA256 6f04cbff5342c341fe4467492ea7be1f32c8b30fd4d98dcc187b6ac4537e5e58
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 8KB
                                                                                            • SHA256 f51a7ee17f31c7fc29034c5df22437aa195014eeb57e7fe0883bb1f2456d2cbc
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 2KB
                                                                                            • SHA256 b44c7bb7a96aa710840f36ee156836708dce9490f570ff3f65267d48ada16d10
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 8KB
                                                                                            • SHA256 4d8b6b4ba7d81b6b8b6464584376ca80d7fb3c3e96c9d9597b1f8ceed97185e7
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 9KB
                                                                                            • SHA256 8939cc16821736745856f6d4e7a7f3430c68c01e6465e9e47d5b51499a428e57
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 8KB
                                                                                            • SHA256 fb3c7b65d9a04ce83641e677bbde3bcf6b2dd1333e8e80116b41c6f16c3b2cff
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 10KB
                                                                                            • SHA256 4d4cb32f5362b6b5bece29accb839b6313f1b26cdd4c5681038dd0d4d3abc4bb
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 8KB
                                                                                            • SHA256 ec65d2c68028ab132569a9ce8e1527344359cef1cf1e81f718e6ba4ced19612d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 9KB
                                                                                            • SHA256 0251c9bd208181dc5e2ab4101620a1bae462c50954d17b40fe7183b4b5261693
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 8KB
                                                                                            • SHA256 32c83acfd58275744992e63209e6c7b45a6f41242d7ba9433e9b6e1dd678ba7e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 9KB
                                                                                            • SHA256 6ed38686bd580b1bc9197dfbef1bea6718d77d55d7347b2e1cb73f8d75201202
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 9KB
                                                                                            • SHA256 9daa16535aa61bf60dd2196f6b76c17b6f947b52f6a6aee547ff8762f4d17ce6
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 9KB
                                                                                            • SHA256 4de8ad24010ea25edd31d10e8faaeaa490fd66d5132daaa5659a5cc9366b5c06
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 10KB
                                                                                            • SHA256 f511f1c4c4beadb4ca893793985574459a947946c4c2fca449f7ce811c25bfc3
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 9KB
                                                                                            • SHA256 5b177a34b1c433327e33c5ffef3509bb0d329a68dec351a79a0cdfc9f8df87f8
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 8KB
                                                                                            • SHA256 8a44f16eac8cf04fb4a45bd31aeb1a07ed3626d735c7649c6a3a6b3cb86597c3
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 8KB
                                                                                            • SHA256 fc1b18bf974709007ce77d5d7c7bc6e31b9ceace32a41c27c499523819148e5a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 9KB
                                                                                            • SHA256 127a6df80fb249abdf47b7a779c8aed83a7622d79f57f824f6ac3d5e2b22471f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 9KB
                                                                                            • SHA256 051279d8e69bc794d9fea674989811cb44f06898c94d96dac3e55894773ca821
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f5efd76d-d54f-4d73-baa0-2730fcc3d0ac.raw
                                                                                            • Size 9KB
                                                                                            • SHA256 330423730c8624902751daac155ef4a28563b7a2aa4d7b4767a6745dbcfed32a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            b7111044-d3fd-4f9c-b733-a7687212cd29.tmp
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\b7111044-d3fd-4f9c-b733-a7687212cd29.tmp
                                                                                            • Size 173B
                                                                                            • SHA256 49ff6d99a1060688e947a285348552fb56b24f5c3ca1962b8ab97f3d40778dd9
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            f4d881a3-5666-4c4e-b91f-01a7d4f89241.tmp
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\f4d881a3-5666-4c4e-b91f-01a7d4f89241.tmp
                                                                                            • Size 171B
                                                                                            • SHA256 a4726a673253fe0d86aa10bfedebb327b8ff94821585ebb10cb896d89c8f063a
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 597B
                                                                                            • SHA256 c210eefd73e84e4ece5bb768197eee5771b5cf202212887c83e7ee52a9a8876f
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 1KB
                                                                                            • SHA256 38cb2bddafa4ecc84814207cd01100825f3fec630ecd6948289d5e919c5ba7ef
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 1KB
                                                                                            • SHA256 ab7da4ca17d57179eae57f6af117be675e7dfec0e721dbd79b5625a1a36c6894
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 2KB
                                                                                            • SHA256 2eeae2046ac767fdee91958f376c7a6c404cbd17931a097039cff91e171b751e
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 870B
                                                                                            • SHA256 4e6ee271fc2406edad91c132a8a6c25b385b878093f6e6183baae7f583fde256
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 1KB
                                                                                            • SHA256 29c351262673aeef674fbe860d69046ee31cf922d51aaeee3bd3aea6ba305938
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 1KB
                                                                                            • SHA256 6cc629672f2c49054e717f995e3c50c053fbe2845faaa288a66a2385c147ac8b
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 1KB
                                                                                            • SHA256 1c8f907b3d1dbdab941b660e1148d3b29262ad380aed4a64a763b53cc5e2b4c2
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 1KB
                                                                                            • SHA256 c571c6432b8f0875ff113af38e78b7bb75517ed75d2c6e6131cf2e3492b43dc9
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 3KB
                                                                                            • SHA256 6b589bdb3c922f95ae853149a57efa167a90b551b941c9468e5e1903160d79d3
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 779B
                                                                                            • SHA256 76875596674d91478da2b11ce5a746a58a0948d024f966db594fdb4661145716
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 963B
                                                                                            • SHA256 c44f4b2eed408e05d920a192bf67a9badf41e8c9bd3338b5bbdde3c692d5a4a0
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 1KB
                                                                                            • SHA256 e3f9355a828c031fac05ac4d52059f64f447183e91fe680976f531b97cbef674
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 3KB
                                                                                            • SHA256 a8a0f4d3f717965bfa4b18f1a445a7370f4f78b0aa27ff6ce9796949a87ac69e
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 690B
                                                                                            • SHA256 c3835d83ac95ef160626262e69cb16fdacb57a6d89f7c69c5f899d4972bdd62a
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 3KB
                                                                                            • SHA256 c51253f40535ec310e135c5bd3aec0e68a60a90f682a65a289f4a8889180e98e
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 3KB
                                                                                            • SHA256 43d02d7c6caff04ee5c447b90c27e075d511ab4d959b5ff1672c701503cba08c
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 3KB
                                                                                            • SHA256 394bd25922412a416c587d0778f221d7113d64f22fb1b2fb930b0d3938b348e2
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 3KB
                                                                                            • SHA256 2eed12703b924b47d215c07ef187444345912a209547adb7594bbe757738726d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 505B
                                                                                            • SHA256 fa542188a1bc86f17866dfa08b90f41f763e6ce551deced90173822857e8cfa4
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 3KB
                                                                                            • SHA256 2ca978466d8dc2d172e5054379c5bbf543abfaf6c307f5d6bd8a6b701ebb898f
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.0.936539210
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.0.936539210
                                                                                            • Size 3KB
                                                                                            • SHA256 819a5b17e5d58d4e5f395a86f937a9206ccebdba4f22a9eb75d5e902d990db3d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.1.962826236
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.1.962826236
                                                                                            • Size 269B
                                                                                            • SHA256 89d70503bb3d5836f98d9bab7fbe59a7fa038c31f1674dd6505d9013463c1356
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.1.962826236
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.1.962826236
                                                                                            • Size 1KB
                                                                                            • SHA256 53b5250f6c74ea614e7b6280ce95b1aab2f38f8dcf6f953ba8ccef215aaab050
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.1.962826236
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.1.962826236
                                                                                            • Size 331B
                                                                                            • SHA256 a5240fe37db1b043d6234f9865bc3e5b0250618816140bffe3b3b098962c1e7d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.1.962826236
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.1.962826236
                                                                                            • Size 2KB
                                                                                            • SHA256 a29cfca399b1db71e6f1cde94fcc6c36ff6904dcd980447f532ac5d933511ed6
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.1.962826236
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.1.962826236
                                                                                            • Size 2KB
                                                                                            • SHA256 01ab0fbf5f424dbbdc4615aa696309a51d5732f0f43ed65604d36cc35d66b8a9
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.1.962826236
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.1.962826236
                                                                                            • Size 2KB
                                                                                            • SHA256 e2407de27319ae4029a55879ab1f7a9f4826b2ae33776674deefca894d095ae3
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.1.962826236
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.1.962826236
                                                                                            • Size 2KB
                                                                                            • SHA256 527a9b64090b208995c18df20e5ea1ad44c1c82615fe9b66090c450364d69598
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.1.962826236
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.1.962826236
                                                                                            • Size 2KB
                                                                                            • SHA256 af08b257d7751d6618c930bd7c28dec07ff3b638958d270c486fde8b701bd6ce
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.1.962826236
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.1.962826236
                                                                                            • Size 2KB
                                                                                            • SHA256 0f306c9d5814e82efa83db36779eca854a017a2e34a4e77010262951414c6ecd
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.1.962826236
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.1.962826236
                                                                                            • Size 2KB
                                                                                            • SHA256 f35d37f4138fe2f7792177f8502e1328fecc21fcef78cab15d9b88b9f5fa2577
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.1.962826236
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.1.962826236
                                                                                            • Size 1KB
                                                                                            • SHA256 3bd64f2a188b685cb1bffeeeeee35992ba377adf96f098bbfc1379f671345409
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.2.422887949
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.2.422887949
                                                                                            • Size 217B
                                                                                            • SHA256 04d864d7a350606db1cd406fa7fdebdd1258200a6248059493cf4edf17104cfe
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ssdfp6232.2.422887949
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6232.2.422887949
                                                                                            • Size 173B
                                                                                            • SHA256 9c0f99b6e32839b0a8b6b2c376477eae7076cf3da96527819b948c4073ec7203
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            data_0
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_0
                                                                                            • Size 8KB
                                                                                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                            Submit Download

                                                                                            data_2
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_2
                                                                                            • Size 8KB
                                                                                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                            Submit Download

                                                                                            data_3
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_3
                                                                                            • Size 8KB
                                                                                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                            Submit Download

                                                                                            Local State
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Local State
                                                                                            • Size 3KB
                                                                                            • SHA256 64580396926eb14c61fd64198212f1d659a3d7df1f75ea326196701c7afc9b49
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            Local State
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Local State
                                                                                            • Size 3KB
                                                                                            • SHA256 3138c696340b95c1766d69ece7676961c9e96241b02de01750e460a06ae01f6b
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            assistant_prefs.json
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\assistant_prefs.json
                                                                                            • Size 151B
                                                                                            • SHA256 e7b37a3fb94f6135ece4287090a3b6ac0fcc3dacc0a93d63584fc52339638a49
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            9e94b247-cb08-46c7-a3b4-35635bacea0d.tmp
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\extensions_crx_cache\9e94b247-cb08-46c7-a3b4-35635bacea0d.tmp
                                                                                            • Size 13B
                                                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            Unconfirmed 465104.crdownload
                                                                                            • Path C:\Users\Admin\Downloads\Unconfirmed 465104.crdownload
                                                                                            • Size 25.5MB
                                                                                            • SHA256 0619bd07d3183a8ae0cb1be408c6ad32295d47ddd666b2d51edd4d5f5d211227
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            desktop.ini
                                                                                            • Path C:\Users\Admin\Videos\Captures\desktop.ini
                                                                                            • Size 190B
                                                                                            • SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            memory/560-0-0x00007FF657FA0000-0x00007FF65957B000-memory.dmp
                                                                                            Download

                                                                                            memory/1908-4034-0x00000128B21D0000-0x00000128B21D1000-memory.dmp
                                                                                            Download

                                                                                            memory/1908-3982-0x00000128B21D0000-0x00000128B21D1000-memory.dmp
                                                                                            Download

                                                                                            memory/1908-4060-0x00000128B21D0000-0x00000128B21D1000-memory.dmp
                                                                                            Download

                                                                                            memory/1908-4048-0x00000128B21D0000-0x00000128B21D1000-memory.dmp
                                                                                            Download

                                                                                            memory/1908-4050-0x00000128B21D0000-0x00000128B21D1000-memory.dmp
                                                                                            Download

                                                                                            memory/3116-2338-0x0000000000E90000-0x0000000001487000-memory.dmp
                                                                                            Download

                                                                                            memory/3116-864-0x0000000000E90000-0x0000000001487000-memory.dmp
                                                                                            Download

                                                                                            memory/3116-961-0x0000000000E90000-0x0000000001487000-memory.dmp
                                                                                            Download

                                                                                            memory/3116-2140-0x0000000000E90000-0x0000000001487000-memory.dmp
                                                                                            Download

                                                                                            memory/5088-2096-0x0000000000B10000-0x0000000001111000-memory.dmp
                                                                                            Download

                                                                                            memory/5088-816-0x0000000000B10000-0x0000000001111000-memory.dmp
                                                                                            Download

                                                                                            memory/5088-2119-0x0000000000B10000-0x0000000001111000-memory.dmp
                                                                                            Download

                                                                                            memory/5088-1678-0x0000000000B10000-0x0000000001111000-memory.dmp
                                                                                            Download

                                                                                            memory/5088-954-0x0000000000B10000-0x0000000001111000-memory.dmp
                                                                                            Download

                                                                                            memory/5088-949-0x0000000000B10000-0x0000000001111000-memory.dmp
                                                                                            Download

                                                                                            memory/5088-819-0x0000000000B10000-0x0000000001111000-memory.dmp
                                                                                            Download

                                                                                            memory/5088-255-0x0000000000B10000-0x0000000001111000-memory.dmp
                                                                                            Download

                                                                                            memory/5976-3566-0x0000000000400000-0x0000000000420000-memory.dmp
                                                                                            Download

                                                                                            memory/6140-3869-0x00000202DB4D0000-0x00000202DB4D1000-memory.dmp
                                                                                            Download

                                                                                            memory/6140-3956-0x00000202DB4D0000-0x00000202DB4D1000-memory.dmp
                                                                                            Download

                                                                                            memory/6140-3830-0x00000202DB4D0000-0x00000202DB4D1000-memory.dmp
                                                                                            Download

                                                                                            memory/6140-3842-0x00000202DB4D0000-0x00000202DB4D1000-memory.dmp
                                                                                            Download

                                                                                            memory/6140-3863-0x00000202DB4D0000-0x00000202DB4D1000-memory.dmp
                                                                                            Download

                                                                                            memory/6140-3872-0x00000202DB4D0000-0x00000202DB4D1000-memory.dmp
                                                                                            Download

                                                                                            memory/6140-3958-0x00000202DB4D0000-0x00000202DB4D1000-memory.dmp
                                                                                            Download

                                                                                            memory/6140-3843-0x00000202DB4D0000-0x00000202DB4D1000-memory.dmp
                                                                                            Download

                                                                                            memory/6140-3986-0x00000202DB4D0000-0x00000202DB4D1000-memory.dmp
                                                                                            Download

                                                                                            memory/6140-3702-0x00000202DB4D0000-0x00000202DB4D1000-memory.dmp
                                                                                            Download

                                                                                            memory/6140-3981-0x00000202DB4D0000-0x00000202DB4D1000-memory.dmp
                                                                                            Download

                                                                                            memory/7072-2008-0x00007FF971190000-0x00007FF971191000-memory.dmp
                                                                                            Download

                                                                                            memory/7072-2007-0x00007FF971440000-0x00007FF971441000-memory.dmp
                                                                                            Download

                                                                                            memory/7632-2112-0x0000000000400000-0x0000000000420000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3542-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3456-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3698-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3652-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3696-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3494-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3687-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3498-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3508-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3538-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3520-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3521-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3516-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3514-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3499-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3496-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3453-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3697-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3463-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3459-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3447-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3443-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3438-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3439-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3356-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-2135-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3714-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3718-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3750-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3776-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3792-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3824-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3947-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3954-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3946-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download

                                                                                            memory/7736-3963-0x000001E137920000-0x000001E137921000-memory.dmp
                                                                                            Download