Overview

overview

8

Static

static

3

BloomFisch....1.exe

windows10-2004-x64

8

BloomFisch....1.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    390s
  • max time network
    395s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/08/2026, 22:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BloomFisching-2.1.1.exe
  • Size 142.3MB
  • Sample260830-2j57vsar3s
  • SHA256 729963effae5b1da13cb6a74ca4539cadb28433816a515cd4fe6992e307c2b23
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 3 IoCs
  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 56 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 62 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\BloomFisching-2.1.1.exe
    "C:\Users\Admin\AppData\Local\Temp\BloomFisching-2.1.1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4388
    • C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\BloomFisching-2.1.1.exe
      C:\Users\Admin\AppData\Local\Temp\BloomFisching-2.1.1.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1256
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1256.2640.5106942129005064816
        3⤵
        • Drops file in Program Files directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:3180
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x158,0x15c,0x160,0x134,0x168,0x7ffe72e0b078,0x7ffe72e0b084,0x7ffe72e0b090
          4⤵
            PID:5060
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1780,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1764 /prefetch:2
            4⤵
              PID:916
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2044,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
              4⤵
                PID:4120
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2036,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:8
                4⤵
                  PID:4680
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3700,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
                  4⤵
                    PID:4116
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4152,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
                    4⤵
                      PID:208
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3876,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:1
                      4⤵
                        PID:3896
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4492,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
                        4⤵
                          PID:2732
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4696,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:1
                          4⤵
                            PID:5016
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5004,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
                            4⤵
                              PID:4336
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5288,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
                              4⤵
                                PID:536
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5616,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
                                4⤵
                                  PID:4968
                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2192,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:8
                                  4⤵
                                    PID:2456
                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=6052,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
                                    4⤵
                                      PID:2656
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5968,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
                                      4⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:6216
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5472,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
                                      4⤵
                                        PID:5116
                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=6008,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
                                        4⤵
                                          PID:6804
                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5432,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1312 /prefetch:8
                                          4⤵
                                            PID:6412
                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4944,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:8
                                            4⤵
                                              PID:9456
                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView" --webview-exe-name=BloomFisching-2.1.1.exe --webview-exe-version=2.1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1308,i,5649199555253399370,7865248857157094743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
                                              4⤵
                                                PID:8344
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://auth.atlasmacro.dev/key?session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjVjYzg3NDMxLTNkYTEtNDRkZi05MDg4LTQyOWYzODQwNDI1YyIsImh3aWQiOiJTLTEtNS0yMS02Njg2Nzk1NzYtMTIwNjQ2NjU5LTIyODkzMzU0NTItMTAwMCIsImlwIjoiODUuMjAzLjQ2LjIyNiIsImFkcyI6e30sImtleSI6bnVsbCwia2V5X2xlbmd0aCI6MCwiZXhwIjoxNzg4MTMxMzk4fQ.or0TnE4H8wKeCshIF936Fh2GAZNxaZ0ta9ai_ygmTm4
                                              3⤵
                                              • Drops file in Program Files directory
                                              • Checks SCSI registry key(s)
                                              • Checks processor information in registry
                                              • Modifies data under HKEY_USERS
                                              • Modifies registry class
                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              • Suspicious use of WriteProcessMemory
                                              PID:4520
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ffe6d26c188,0x7ffe6d26c194,0x7ffe6d26c1a0
                                                4⤵
                                                  PID:1036
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,10487728373139675464,3875476675953279604,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:3
                                                  4⤵
                                                  • Downloads MZ/PE file
                                                  • System Time Discovery
                                                  PID:5268
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,6951734836089953911,7020580357144842055,262144 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:2
                                                  4⤵
                                                    PID:5284
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,13241838451657414212,18047878259302019054,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
                                                    4⤵
                                                      PID:5292
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,11822748003273680938,4673953207522358368,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
                                                      4⤵
                                                        PID:5436
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,17359152373537484532,7910807374676189441,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
                                                        4⤵
                                                          PID:5444
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,7616280598008906006,14853005940937280555,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
                                                          4⤵
                                                            PID:5540
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,7319607401952559546,866493686182497155,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
                                                            4⤵
                                                              PID:5548
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,16068259316834769827,10494345776352375618,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
                                                              4⤵
                                                                PID:5920
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,11978340044052773550,10865363039285474157,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
                                                                4⤵
                                                                  PID:6116
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4956,i,13937373210157250804,7084887158141494660,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
                                                                  4⤵
                                                                    PID:5988
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5104,i,16079634882845154117,8611220288146891185,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
                                                                    4⤵
                                                                      PID:5844
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,3857368404184275094,15610153700488981445,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
                                                                      4⤵
                                                                        PID:5960
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,10935468730794745920,1003860982072176620,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
                                                                        4⤵
                                                                          PID:5920
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6080,i,17392142878471690356,7221970408651132137,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
                                                                          4⤵
                                                                            PID:6120
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,7096186853046764125,2142988371046416765,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
                                                                            4⤵
                                                                              PID:5300
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,7096186853046764125,2142988371046416765,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
                                                                              4⤵
                                                                                PID:6160
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,1018920339336735990,10744388277605741951,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
                                                                                4⤵
                                                                                  PID:6452
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,14202060232342206010,1893485830706660387,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
                                                                                  4⤵
                                                                                    PID:6464
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,17108069664957491404,8514507290308135319,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
                                                                                    4⤵
                                                                                      PID:6648
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,1009660087757432953,15609000660253799481,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:8
                                                                                      4⤵
                                                                                        PID:6712
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7416,i,1430217741865720101,11044491575431494459,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:8
                                                                                        4⤵
                                                                                          PID:7144
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,3674122727465179530,15783771957592822032,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
                                                                                          4⤵
                                                                                            PID:6528
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,3133493693002817490,13849905068974598502,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
                                                                                            4⤵
                                                                                              PID:6520
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,16954097053577510464,14784831127398440786,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
                                                                                              4⤵
                                                                                                PID:6532
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5500,i,507501602665012923,10380121368588558452,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
                                                                                                4⤵
                                                                                                  PID:6932
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=2648,i,17310450418354243701,5666709034631040721,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
                                                                                                  4⤵
                                                                                                    PID:6988
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3752,i,2560721773554447782,11458692085048689651,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
                                                                                                    4⤵
                                                                                                      PID:5684
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=696,i,16775357708267110960,1989208177369179800,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
                                                                                                      4⤵
                                                                                                        PID:6336
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=3500,i,2078125825661699089,10884129466243596765,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
                                                                                                        4⤵
                                                                                                          PID:6380
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7664,i,10910931866611965693,8949998883540672989,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:1
                                                                                                          4⤵
                                                                                                            PID:4476
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7784,i,7421720971616173618,5030644344815581625,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:1
                                                                                                            4⤵
                                                                                                              PID:3276
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7832,i,8331661774677975676,13052370873208535674,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:1
                                                                                                              4⤵
                                                                                                                PID:5868
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7644,i,941919672780577105,17612299846548506413,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
                                                                                                                4⤵
                                                                                                                  PID:6052
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,13126183406450516330,16203714908591741140,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
                                                                                                                  4⤵
                                                                                                                    PID:1472
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,14217046195375711816,17501992598067940470,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8
                                                                                                                    4⤵
                                                                                                                      PID:432
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=852,i,3596042659445146515,4424229470725224041,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
                                                                                                                      4⤵
                                                                                                                        PID:5360
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,16586355458544277415,15052884804602542310,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:8
                                                                                                                        4⤵
                                                                                                                          PID:6988
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7624,i,6726438887637458144,11643374058778672853,262144 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7972 /prefetch:8
                                                                                                                          4⤵
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:6468
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5780,i,18286446860356128570,10176439795774188039,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
                                                                                                                          4⤵
                                                                                                                            PID:4356
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7760,i,504609315982546860,8682475151087686924,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
                                                                                                                            4⤵
                                                                                                                              PID:4720
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7960,i,11495177947716156724,2244568899124657408,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
                                                                                                                              4⤵
                                                                                                                                PID:5452
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=6500,i,9600317608946747629,12537786588557617684,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
                                                                                                                                4⤵
                                                                                                                                  PID:5920
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,7648411168834765564,18100259104814084923,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
                                                                                                                                  4⤵
                                                                                                                                    PID:6712
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,15125528942932233774,7895160497798344287,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
                                                                                                                                    4⤵
                                                                                                                                      PID:4176
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=6416,i,10024224532617297552,3530190796106918604,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
                                                                                                                                      4⤵
                                                                                                                                        PID:3472
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,10666836383018223643,15600928287476110693,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
                                                                                                                                        4⤵
                                                                                                                                          PID:2212
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7800,i,3301992387417280577,10634858484802019046,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:8
                                                                                                                                          4⤵
                                                                                                                                            PID:6080
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7800,i,3301992387417280577,10634858484802019046,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:8
                                                                                                                                            4⤵
                                                                                                                                              PID:5308
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=3584,i,9014221956000379843,8466120441826955171,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7888 /prefetch:1
                                                                                                                                              4⤵
                                                                                                                                                PID:6120
                                                                                                                                              • C:\Users\Admin\Downloads\OperaGXSetup.exe
                                                                                                                                                "C:\Users\Admin\Downloads\OperaGXSetup.exe"
                                                                                                                                                4⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:5788
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC96CB30B\installer.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSC96CB30B\installer.exe --server-tracking-blob=Njk1MjVlNmFmMGFhOTk1MTA3NGU0NTdjNzAxZDlkZjg2MjkwNWUwNmVkNjVkY2JjNGMzZjI3YzQ4NmU2YTU5ZDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9HQl9TVlJfODg3NV9PT01fMTM1OCZlZGl0aW9uPXN0ZC0yJnV0bV9pZD01ZDg2NGVhZjZkZWM0NWY0YmE3NWEyNDQ2MDkyODIzZiZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRmd4JTNGdXRtX3NvdXJjZSUzRFBXTmdhbWVzJTI2dXRtX21lZGl1bSUzRHBhJTI2dXRtX2NhbXBhaWduJTNEUFdOX0dCX1NWUl84ODc1X09PTV8xMzU4JTI2dXRtX2lkJTNENWQ4NjRlYWY2ZGVjNDVmNGJhNzVhMjQ0NjA5MjgyM2YlMjZlZGl0aW9uJTNEc3RkLTImdXRtX3NpdGU9b3BlcmFfY29tJnV0bV9sYXN0cGFnZT1vcGVyYS5jb20lMkZneCZ1dG1faWQ9NWQ4NjRlYWY2ZGVjNDVmNGJhNzVhMjQ0NjA5MjgyM2YmZGxfdG9rZW49NTczODMyNjMiLCJ0aW1lc3RhbXAiOiIxNzg4MTI5NzM3LjkyMjAiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTM5LjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzEzOS4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9TVlJfODg3NV9PT01fMTM1OCIsImlkIjoiNWQ4NjRlYWY2ZGVjNDVmNGJhNzVhMjQ0NjA5MjgyM2YiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9neCIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJmZDIyYzdjOC0yODFlLTRlYjctYmQ1OS0xNjQ0YTRlOWVkYmYifQ==
                                                                                                                                                  5⤵
                                                                                                                                                  • Downloads MZ/PE file
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                  • Modifies system certificate store
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:5964
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC96CB30B\installer.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSC96CB30B\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=135.0.5973.57 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff61ab11608,0x7ff61ab11618,0x7ff61ab11628
                                                                                                                                                    6⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:4032
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\installer.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\installer.exe" --version
                                                                                                                                                    6⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:1656
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC96CB30B\installer.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSC96CB30B\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=5964 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\opera_package_20260830234229" --session-guid=f644054f-da58-46c5-aa84-0d6fc5b600b5 --server-tracking-blob=MjU3YzBkN2U1NWVkZTYxOGFkMzQzZGRlZTU0N2M4NzUyZGJlM2I3NDM3NDcxMTc5MjMxMmZmOWRiYzUwNDU3OTp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6eyJuYW1lIjoib3BlcmFfZ3gifSwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9HQl9TVlJfODg3NV9PT01fMTM1OCZlZGl0aW9uPXN0ZC0yJnV0bV9pZD01ZDg2NGVhZjZkZWM0NWY0YmE3NWEyNDQ2MDkyODIzZiZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRmd4JTNGdXRtX3NvdXJjZSUzRFBXTmdhbWVzJTI2dXRtX21lZGl1bSUzRHBhJTI2dXRtX2NhbXBhaWduJTNEUFdOX0dCX1NWUl84ODc1X09PTV8xMzU4JTI2dXRtX2lkJTNENWQ4NjRlYWY2ZGVjNDVmNGJhNzVhMjQ0NjA5MjgyM2YlMjZlZGl0aW9uJTNEc3RkLTImdXRtX3NpdGU9b3BlcmFfY29tJnV0bV9sYXN0cGFnZT1vcGVyYS5jb20lMkZneCZ1dG1faWQ9NWQ4NjRlYWY2ZGVjNDVmNGJhNzVhMjQ0NjA5MjgyM2YmZGxfdG9rZW49NTczODMyNjMiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3ODgxMjk3MzcuOTIyMCIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMzkuMC4wLjAgU2FmYXJpLzUzNy4zNiBFZGcvMTM5LjAuMC4wIiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0dCX1NWUl84ODc1X09PTV8xMzU4IiwiaWQiOiI1ZDg2NGVhZjZkZWM0NWY0YmE3NWEyNDQ2MDkyODIzZiIsImxhc3RwYWdlIjoib3BlcmEuY29tL2d4IiwibWVkaXVtIjoicGEiLCJzaXRlIjoib3BlcmFfY29tIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImZkMjJjN2M4LTI4MWUtNGViNy1iZDU5LTE2NDRhNGU5ZWRiZiJ9 --desktopshortcut=1 --wait-for-package --initial-proc-handle=5C08000000000000
                                                                                                                                                    6⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                    PID:6612
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC96CB30B\installer.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSC96CB30B\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=135.0.5973.57 --initial-client-data=0x28c,0x290,0x294,0x25c,0x298,0x7ff61ab11608,0x7ff61ab11618,0x7ff61ab11628
                                                                                                                                                      7⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:6600
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\installer.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\installer.exe" --backend --initial-pid=5964 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\opera_package_202608302342291" --session-guid=f644054f-da58-46c5-aa84-0d6fc5b600b5 --server-tracking-blob=MjU3YzBkN2U1NWVkZTYxOGFkMzQzZGRlZTU0N2M4NzUyZGJlM2I3NDM3NDcxMTc5MjMxMmZmOWRiYzUwNDU3OTp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6eyJuYW1lIjoib3BlcmFfZ3gifSwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9HQl9TVlJfODg3NV9PT01fMTM1OCZlZGl0aW9uPXN0ZC0yJnV0bV9pZD01ZDg2NGVhZjZkZWM0NWY0YmE3NWEyNDQ2MDkyODIzZiZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRmd4JTNGdXRtX3NvdXJjZSUzRFBXTmdhbWVzJTI2dXRtX21lZGl1bSUzRHBhJTI2dXRtX2NhbXBhaWduJTNEUFdOX0dCX1NWUl84ODc1X09PTV8xMzU4JTI2dXRtX2lkJTNENWQ4NjRlYWY2ZGVjNDVmNGJhNzVhMjQ0NjA5MjgyM2YlMjZlZGl0aW9uJTNEc3RkLTImdXRtX3NpdGU9b3BlcmFfY29tJnV0bV9sYXN0cGFnZT1vcGVyYS5jb20lMkZneCZ1dG1faWQ9NWQ4NjRlYWY2ZGVjNDVmNGJhNzVhMjQ0NjA5MjgyM2YmZGxfdG9rZW49NTczODMyNjMiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3ODgxMjk3MzcuOTIyMCIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMzkuMC4wLjAgU2FmYXJpLzUzNy4zNiBFZGcvMTM5LjAuMC4wIiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0dCX1NWUl84ODc1X09PTV8xMzU4IiwiaWQiOiI1ZDg2NGVhZjZkZWM0NWY0YmE3NWEyNDQ2MDkyODIzZiIsImxhc3RwYWdlIjoib3BlcmEuY29tL2d4IiwibWVkaXVtIjoicGEiLCJzaXRlIjoib3BlcmFfY29tIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImZkMjJjN2M4LTI4MWUtNGViNy1iZDU5LTE2NDRhNGU5ZWRiZiJ9 --desktopshortcut=1 --install-subfolder=134.0.5954.67
                                                                                                                                                      7⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:1808
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\installer.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff7c79fbd88,0x7ff7c79fbd94,0x7ff7c79fbda0
                                                                                                                                                        8⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:2588
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\opera_package_202608302342291\assistant\assistant_installer.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\opera_package_202608302342291\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --copyonly=0 --allusers=0
                                                                                                                                                        8⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                        PID:4592
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\opera_package_202608302342291\assistant\assistant_installer.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\opera_package_202608302342291\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0xc3cb80,0xc3cb8c,0xc3cb98
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:6488
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --run-assistant --allusers=0
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:1816
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0xd0cb80,0xd0cb8c,0xd0cb98
                                                                                                                                                            10⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:6976
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe"
                                                                                                                                                            10⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                            PID:7004
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                                                                                                                              11⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                              PID:7100
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x190,0x194,0x18c,0x15c,0x188,0x7ffe3dd55310,0x7ffe3dd55320,0x7ffe3dd55330
                                                                                                                                                                12⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:6788
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                                                                                                                              11⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                              PID:6736
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x190,0x194,0x18c,0x15c,0x188,0x7ffe3dd55310,0x7ffe3dd55320,0x7ffe3dd55330
                                                                                                                                                                12⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5868
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0xa5e2bc,0xa5e2c8,0xa5e2d4
                                                                                                                                                              11⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:1216
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                                                                                                                                12⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                PID:6748
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x190,0x194,0x18c,0xf8,0x188,0x7ffe3dd55310,0x7ffe3dd55320,0x7ffe3dd55330
                                                                                                                                                                  13⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:5888
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                                                                                                                                12⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                PID:1288
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x190,0x194,0x18c,0x15c,0x188,0x7ffe3dd55310,0x7ffe3dd55320,0x7ffe3dd55330
                                                                                                                                                                  13⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:3892
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                                                                                                                                12⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                PID:6448
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x190,0x194,0x18c,0x15c,0x188,0x7ffe3dd55310,0x7ffe3dd55320,0x7ffe3dd55330
                                                                                                                                                                  13⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:932
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
                                                                                                                                                        8⤵
                                                                                                                                                        • Checks computer location settings
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                        PID:6140
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x1d4,0x1d8,0x1d0,0x1a0,0x1cc,0x7ffe3dd55310,0x7ffe3dd55320,0x7ffe3dd55330
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:6624
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1648,i,17991602696605683703,17780130208222390764,262144 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1896 /prefetch:2
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:7440
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=2140,i,7360832427130883393,10599744201108656900,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2156 /prefetch:3
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • System Time Discovery
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:7568
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=2408,i,4027729743512101313,5193618895271466076,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3348 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:7764
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=2760,i,17370365814161775977,2972074544692254775,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3376 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:7772
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=2792,i,6293283596925565663,13605309031958627788,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3388 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:7780
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=2804,i,8648006361475583994,7395569671610449382,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3416 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:7788
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=2816,i,6046554296988518069,4663744650022432809,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3428 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:7796
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=2828,i,10966837995412831595,17078645385296234973,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3456 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:7804
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=2840,i,17860644313480338161,4903903828789193524,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3468 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:7812
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=2920,i,7085853354967281474,12673012428185628858,2097152 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3496 /prefetch:1
                                                                                                                                                          9⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:7820
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_gx_splash.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_gx_splash.exe" --instance-name=61C8973803226C4D4008DEBC18682105EDAB1556896BB924D0EEB1B6C96AB147
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:7720
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4648,i,4795580639580406089,6839179636868415383,2097152 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4676 /prefetch:1
                                                                                                                                                          9⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:7560
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4840,i,10874935035039411188,17139604662245351718,2097152 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4860 /prefetch:2
                                                                                                                                                          9⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:4220
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5008,i,7401954258328877386,3301299034655320622,2097152 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5028 /prefetch:1
                                                                                                                                                          9⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:7736
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --asus-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=5068,i,11107819811783859296,2119013113794330022,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5268 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:7724
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5060,i,2561652725388480402,5031419506114386136,2097152 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5244 /prefetch:1
                                                                                                                                                          9⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:7620
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --corsair-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=5072,i,11264611860234438063,15863999171198188900,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5272 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:2736
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --logitech-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=5076,i,18205554744853559505,8951902468565555458,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5240 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:3472
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --razer-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=5080,i,9936872057879333710,10452241114673187100,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5308 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:780
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5776,i,13763547555121425563,9262704594309533037,2097152 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=5096 /prefetch:2
                                                                                                                                                          9⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:7204
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=1684,i,7336207336900443455,8357915635928314388,2097152 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6608 /prefetch:2
                                                                                                                                                          9⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:7256
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6444,i,15023916388371665233,7356799759918329222,2097152 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6340 /prefetch:1
                                                                                                                                                          9⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:8372
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=2796,i,4379892332447961193,16234096228500668838,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=3448 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:8864
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7096,i,5158945927422900583,17772196860724660929,2097152 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=5668 /prefetch:2
                                                                                                                                                          9⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          PID:9012
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3716,i,695919801168814424,11309481257374230859,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=3784 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:9036
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3760,i,3984210133164771550,4405101855727808426,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=4028 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:9048
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=5756,i,11297609680016809907,7579431259331257951,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7124 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:9060
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=6428,i,8438384950349714447,14225957232986745001,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7156 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:9068
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3936,i,13777937011573136599,10581446100346198042,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=3900 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:9104
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7316,i,3532513176844874221,1452964280899319354,2097152 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=7028 /prefetch:2
                                                                                                                                                          9⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:9008
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7244,i,11080916553361633915,8672574054615764929,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=7492 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                            PID:9188
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7232,i,7069410607360428253,10328858185033855531,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=7500 /prefetch:8
                                                                                                                                                            9⤵
                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                            PID:9024
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7456,i,470383212713340604,5089264263227530733,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=7528 /prefetch:8
                                                                                                                                                            9⤵
                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                            PID:6228
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7444,i,12229889857897765743,11442566617289893490,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=7572 /prefetch:8
                                                                                                                                                            9⤵
                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                            PID:8096
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7480,i,12836755487508536699,15177997114137316491,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=7604 /prefetch:8
                                                                                                                                                            9⤵
                                                                                                                                                              PID:9052
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7468,i,9871356576985030994,16987402305795842531,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=7548 /prefetch:8
                                                                                                                                                              9⤵
                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                              PID:4936
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=8216,i,14930914237647005729,17401162389169676614,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=8228 /prefetch:8
                                                                                                                                                              9⤵
                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                              PID:9288
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --pipeid=oauc_pipeF347B60CA73F3F3DA84B31019F4EB851ECFC332513021FC062CC0CA8D8440B54
                                                                                                                                                              9⤵
                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                              PID:9900
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff6c7cf38d0,0x7ff6c7cf38dc,0x7ff6c7cf38e8
                                                                                                                                                                10⤵
                                                                                                                                                                  PID:9944
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=8592,i,17095549639145935839,9058289340971692735,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=8648 /prefetch:8
                                                                                                                                                                9⤵
                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                PID:9520
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\installer.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\installer.exe" --fix-taskbar-pins
                                                                                                                                                                9⤵
                                                                                                                                                                  PID:9424
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\installer.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff7c79fbd88,0x7ff7c79fbd94,0x7ff7c79fbda0
                                                                                                                                                                    10⤵
                                                                                                                                                                      PID:10044
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=2920,i,15083662027658126894,11544497889684902971,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=8656 /prefetch:8
                                                                                                                                                                    9⤵
                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                    PID:9220
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=9176,i,9475158464938323856,4970085938672493975,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=9304 /prefetch:8
                                                                                                                                                                    9⤵
                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                    PID:10004
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=9460,i,11463327290935993471,10127419030083316345,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=9472 /prefetch:8
                                                                                                                                                                    9⤵
                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                    PID:10080
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.side_profiles.mojom.SideProfilesHandler --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:continue-on-support-with-booking=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:improved-adblocker=off --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=9620,i,12656463852051399843,100889510228979365,524288 --field-trial-handle=1900,i,7977501749758354963,13244238945400979758,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,5781313323224399381,6958517552486264448,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=9616 /prefetch:8
                                                                                                                                                                    9⤵
                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                    PID:8808
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\opera_package_202608302342291\assistant\Opera_GX_assistant_134.0.5954.44_Setup.exe_sfx.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\opera_package_202608302342291\assistant\Opera_GX_assistant_134.0.5954.44_Setup.exe_sfx.exe"
                                                                                                                                                              6⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:2972
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\opera_package_202608302342291\assistant\assistant_installer.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\opera_package_202608302342291\assistant\assistant_installer.exe" --version
                                                                                                                                                              6⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                              PID:6496
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\opera_package_202608302342291\assistant\assistant_installer.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\opera_package_202608302342291\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0xc3cb80,0xc3cb8c,0xc3cb98
                                                                                                                                                                7⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:1436
                                                                                                                                                        • C:\Users\Admin\Downloads\OperaGXSetup.exe
                                                                                                                                                          "C:\Users\Admin\Downloads\OperaGXSetup.exe"
                                                                                                                                                          4⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:6404
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS409A702B\installer.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS409A702B\installer.exe --server-tracking-blob=Njk1MjVlNmFmMGFhOTk1MTA3NGU0NTdjNzAxZDlkZjg2MjkwNWUwNmVkNjVkY2JjNGMzZjI3YzQ4NmU2YTU5ZDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9HQl9TVlJfODg3NV9PT01fMTM1OCZlZGl0aW9uPXN0ZC0yJnV0bV9pZD01ZDg2NGVhZjZkZWM0NWY0YmE3NWEyNDQ2MDkyODIzZiZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRmd4JTNGdXRtX3NvdXJjZSUzRFBXTmdhbWVzJTI2dXRtX21lZGl1bSUzRHBhJTI2dXRtX2NhbXBhaWduJTNEUFdOX0dCX1NWUl84ODc1X09PTV8xMzU4JTI2dXRtX2lkJTNENWQ4NjRlYWY2ZGVjNDVmNGJhNzVhMjQ0NjA5MjgyM2YlMjZlZGl0aW9uJTNEc3RkLTImdXRtX3NpdGU9b3BlcmFfY29tJnV0bV9sYXN0cGFnZT1vcGVyYS5jb20lMkZneCZ1dG1faWQ9NWQ4NjRlYWY2ZGVjNDVmNGJhNzVhMjQ0NjA5MjgyM2YmZGxfdG9rZW49NTczODMyNjMiLCJ0aW1lc3RhbXAiOiIxNzg4MTI5NzM3LjkyMjAiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTM5LjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzEzOS4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9TVlJfODg3NV9PT01fMTM1OCIsImlkIjoiNWQ4NjRlYWY2ZGVjNDVmNGJhNzVhMjQ0NjA5MjgyM2YiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9neCIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJmZDIyYzdjOC0yODFlLTRlYjctYmQ1OS0xNjQ0YTRlOWVkYmYifQ==
                                                                                                                                                            5⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                            PID:6044
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS409A702B\installer.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS409A702B\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=135.0.5973.57 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff700431608,0x7ff700431618,0x7ff700431628
                                                                                                                                                              6⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:4952
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\447a7f42-dc5e-4a12-b69c-ad25a0631e9f Opera GX Installer Temp\installer.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\.opera\447a7f42-dc5e-4a12-b69c-ad25a0631e9f Opera GX Installer Temp\installer.exe" --version
                                                                                                                                                              6⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:6608
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7668,i,13879032667795890455,2938422164627618070,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=8152 /prefetch:8
                                                                                                                                                          4⤵
                                                                                                                                                            PID:6556
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8164,i,5733496831538174510,11640433731796604364,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:8
                                                                                                                                                            4⤵
                                                                                                                                                              PID:4948
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8076,i,16189875113148486355,12092099883305151278,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
                                                                                                                                                              4⤵
                                                                                                                                                                PID:880
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,2452469623076165190,15163300098179525754,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:2380
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=7588,i,8478547275731131437,6804603788965471464,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:1
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:3960
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=7796,i,13057305057927778634,12234957590861961211,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:1
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:1816
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=6908,i,16131821238665940951,15266458951230221956,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:1
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:5368
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=6748,i,2418340363283223625,9425239470128710196,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:1
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:1356
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=7260,i,8150172865031259764,7637401977138792068,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:6104
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=6744,i,1567452107449995654,2526340073220587858,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:1
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:6596
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=6652,i,17023883461747085822,14089505985542524907,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:1
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:4136
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8288,i,9351325807693423755,15388071092266088127,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=8248 /prefetch:1
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:6132
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7928,i,14980413559653523918,17587476760072436489,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:8
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:8416
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8120,i,5422166022073391519,6775222158736704505,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:9500
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=7264,i,7902503785023760971,6745397786516039704,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:1
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:10124
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8412,i,7087973780503819368,8207436795595784267,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:1
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:10208
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=7164,i,7512735393336621688,1096722153636707752,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:1
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:8644
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=8580,i,12374655852985530192,6269227209164791490,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=8564 /prefetch:1
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:10036
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=8240,i,4695745309859448993,8295802219234085687,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=8352 /prefetch:1
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:8052
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=8564,i,10268094150100518653,8559159700418365266,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:8764
                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=8524,i,12192635112262834592,5070062628105131777,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:8856
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,5319125306969370496,13120042573553250812,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:6208
                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7172,i,6844013384723379243,18069731146076779364,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:8892
                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8716,i,2636212143401495117,9106336413873555840,524288 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=8696 /prefetch:8
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:6656
                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=8348,i,11872372993627832623,15951034258168556877,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:8712
                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=5468,i,11866283448252287929,5589344378095861397,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=8848 /prefetch:1
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:8828
                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=6364,i,16794722361896880545,2104804518798850479,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:9260
                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=4176,i,6549575607130208925,3509641541611607090,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:8180
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=3552,i,16073788510875238127,5641701704906071120,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:1
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:8512
                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=8488,i,11214843334224410840,14494074374967264699,2097152 --field-trial-handle=2728,i,8073048565032502302,260784608953325480,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:1352
                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://auth.atlasmacro.dev/key?session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjVjYzg3NDMxLTNkYTEtNDRkZi05MDg4LTQyOWYzODQwNDI1YyIsImh3aWQiOiJTLTEtNS0yMS02Njg2Nzk1NzYtMTIwNjQ2NjU5LTIyODkzMzU0NTItMTAwMCIsImlwIjoiODUuMjAzLjQ2LjIyNiIsImFkcyI6e30sImtleSI6bnVsbCwia2V5X2xlbmd0aCI6MCwiZXhwIjoxNzg4MTMxMzk4fQ.or0TnE4H8wKeCshIF936Fh2GAZNxaZ0ta9ai_ygmTm4
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:10004
                                                                                                                                                                                                                • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:1680
                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:5692
                                                                                                                                                                                                                    • C:\Windows\system32\wbem\unsecapp.exe
                                                                                                                                                                                                                      C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:3844
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --autostart
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                        PID:7548
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x19c,0x1a0,0x198,0x168,0x194,0x7ffe3dd55310,0x7ffe3dd55320,0x7ffe3dd55330
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:7832
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe7FAE56220944838BCDB933E86AD23A432FE91C0ADA84DF94778C72EE141B2B1F
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                        PID:9508
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.67 --initial-client-data=0x274,0x278,0x27c,0x210,0x280,0x7ff6c7cf38d0,0x7ff6c7cf38dc,0x7ff6c7cf38e8
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:7956

                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                                                              Resource Development

                                                                                                                                                                                                                              Initial Access

                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                              Event Triggered Execution

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1546

                                                                                                                                                                                                                              Component Object Model Hijacking

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1546.015

                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                              Event Triggered Execution

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1546

                                                                                                                                                                                                                              Component Object Model Hijacking

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1546.015

                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                                              3
                                                                                                                                                                                                                              T1112

                                                                                                                                                                                                                              Subvert Trust Controls

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1553

                                                                                                                                                                                                                              Install Root Certificate

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1553.004

                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                              Credentials from Password Stores

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1555

                                                                                                                                                                                                                              Credentials from Web Browsers

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1555.003

                                                                                                                                                                                                                              Unsecured Credentials

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1552

                                                                                                                                                                                                                              Credentials In Files

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1552.001

                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                              Browser Information Discovery

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1217

                                                                                                                                                                                                                              Network Share Discovery

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1135

                                                                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                                                                              2
                                                                                                                                                                                                                              T1120

                                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                                              7
                                                                                                                                                                                                                              T1012

                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                              7
                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                              System Location Discovery

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1614

                                                                                                                                                                                                                              System Language Discovery

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1614.001

                                                                                                                                                                                                                              System Time Discovery

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1124

                                                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                              Data from Local System

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1005

                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                                                              Impact

                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3180_105625016\manifest.json
                                                                                                                                                                                                                              • Size 69B
                                                                                                                                                                                                                              • SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3180_1347306334\manifest.json
                                                                                                                                                                                                                              • Size 76B
                                                                                                                                                                                                                              • SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.fingerprint
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3180_1529808669\manifest.fingerprint
                                                                                                                                                                                                                              • Size 66B
                                                                                                                                                                                                                              • SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3180_1529808669\manifest.json
                                                                                                                                                                                                                              • Size 135B
                                                                                                                                                                                                                              • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3180_2042777132\manifest.json
                                                                                                                                                                                                                              • Size 116B
                                                                                                                                                                                                                              • SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              hyph-bn.hyb
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3180_285233906\hyph-bn.hyb
                                                                                                                                                                                                                              • Size 703B
                                                                                                                                                                                                                              • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              hyph-hi.hyb
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3180_285233906\hyph-hi.hyb
                                                                                                                                                                                                                              • Size 687B
                                                                                                                                                                                                                              • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              hyph-nb.hyb
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3180_285233906\hyph-nb.hyb
                                                                                                                                                                                                                              • Size 141KB
                                                                                                                                                                                                                              • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3180_285233906\manifest.json
                                                                                                                                                                                                                              • Size 82B
                                                                                                                                                                                                                              • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3180_458329078\manifest.json
                                                                                                                                                                                                                              • Size 113B
                                                                                                                                                                                                                              • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4520_1306440065\manifest.json
                                                                                                                                                                                                                              • Size 135B
                                                                                                                                                                                                                              • SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4520_140947417\manifest.json
                                                                                                                                                                                                                              • Size 160B
                                                                                                                                                                                                                              • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4520_1454383105\manifest.json
                                                                                                                                                                                                                              • Size 85B
                                                                                                                                                                                                                              • SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4520_1792808426\manifest.json
                                                                                                                                                                                                                              • Size 177B
                                                                                                                                                                                                                              • SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4520_1810497661\manifest.json
                                                                                                                                                                                                                              • Size 43B
                                                                                                                                                                                                                              • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4520_2097697701\manifest.json
                                                                                                                                                                                                                              • Size 165B
                                                                                                                                                                                                                              • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              LICENSE
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4520_913577099\LICENSE
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4520_913577099\manifest.json
                                                                                                                                                                                                                              • Size 78B
                                                                                                                                                                                                                              • SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              CrashpadMetrics-active.pma
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
                                                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                                                              • SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                              • SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                              • SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              LOG.old
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                                                                              • Size 334B
                                                                                                                                                                                                                              • SHA256 18131c8ffc65113ca0192f50cf8f68893543827d75899c67a069119e47d739cd
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_000085
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
                                                                                                                                                                                                                              • Size 55KB
                                                                                                                                                                                                                              • SHA256 b0c78fb21ad48b316458f939b21411c4b4fdd7cf6fe52a54267a899a55c0249d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_000086
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
                                                                                                                                                                                                                              • Size 144KB
                                                                                                                                                                                                                              • SHA256 0ed77318b7972313fb5702505b9b5cf6574cdae5736af6c6aabb87588b76790e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_000088
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
                                                                                                                                                                                                                              • Size 162KB
                                                                                                                                                                                                                              • SHA256 638e5e9a06489f3bc0be4c14c69fd2e09e69060346d76e44e9b9e2fbe6521ecd
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_000089
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
                                                                                                                                                                                                                              • Size 112KB
                                                                                                                                                                                                                              • SHA256 5cb7103e4e605989afebc03d989c79201e54b21b5183db33981f70db9178a301
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_00008a
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
                                                                                                                                                                                                                              • Size 112KB
                                                                                                                                                                                                                              • SHA256 fa888127b6da015b65569f0351f3b5c391ad928904951f1c20e9f8462a8d95ea
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_00008c
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
                                                                                                                                                                                                                              • Size 343KB
                                                                                                                                                                                                                              • SHA256 07afd00bc6b13e35f702104aebea04e61d7f90b8447559279895e5f72cabd471
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_00008e
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
                                                                                                                                                                                                                              • Size 21KB
                                                                                                                                                                                                                              • SHA256 0035839f97544723c93fdc2a16786821bccbe601d1009453acb3742d59b5e60f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_00009f
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
                                                                                                                                                                                                                              • Size 27KB
                                                                                                                                                                                                                              • SHA256 8073ff708bc0b02ec62325fcc119b7cc6ee9df9a47627167da0d48128781891c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000a0
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
                                                                                                                                                                                                                              • Size 22KB
                                                                                                                                                                                                                              • SHA256 d597e805588e63f5c3fc5f771d8c7d90e36d8407f6144ef41e85c64f448cf657
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000a1
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
                                                                                                                                                                                                                              • Size 25KB
                                                                                                                                                                                                                              • SHA256 a1ff7b3cf1549f9152aee9bf7d475ec69f4a5d844c4054fa53a68102c758100f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000a2
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
                                                                                                                                                                                                                              • Size 48KB
                                                                                                                                                                                                                              • SHA256 58542711acbce8c8e5023990a42b16d5ffb020e15c947274f096ec2f5dfd120f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000a3
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
                                                                                                                                                                                                                              • Size 54KB
                                                                                                                                                                                                                              • SHA256 767f1518a14e2e708fc7d50d3e1076c3ff0b7415f7a0cf37d4b06ed70abe83a3
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000a4
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
                                                                                                                                                                                                                              • Size 32KB
                                                                                                                                                                                                                              • SHA256 862b40952004f0e6f33b91a3807ab5db5d6fdc3951ff08abbb0db11ff78a7ad5
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000a5
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
                                                                                                                                                                                                                              • Size 23KB
                                                                                                                                                                                                                              • SHA256 0d048f70a144d795598c1795a7cd0a94a1cf75c2a1a2ca61e33bca7c4830a0fa
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000a6
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
                                                                                                                                                                                                                              • Size 163KB
                                                                                                                                                                                                                              • SHA256 316fbea01fc4a071789f1b8d973d1e6b60371b7c1d275767eb40f1f0c9f7d2e1
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000a7
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a7
                                                                                                                                                                                                                              • Size 53KB
                                                                                                                                                                                                                              • SHA256 49ab4b3b4c2d7259293a9160b0df07512177794633f9505356442ee9d8d7e688
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000a8
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
                                                                                                                                                                                                                              • Size 178KB
                                                                                                                                                                                                                              • SHA256 01e81bd4614304dc8b71d82cbed6c7680aabc76964d8bbba4efba7d25d1f6249
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000a9
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a9
                                                                                                                                                                                                                              • Size 37KB
                                                                                                                                                                                                                              • SHA256 98c918ce6e2a6e3974208f317ea8f2ec1548a3f57bc077801df02b0c525312c4
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000aa
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
                                                                                                                                                                                                                              • Size 23KB
                                                                                                                                                                                                                              • SHA256 aac638f7503cebb084ec494cf00f75f7d8260d50c2f4e7820bccabba09626a3a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000ab
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ab
                                                                                                                                                                                                                              • Size 23KB
                                                                                                                                                                                                                              • SHA256 e50bbfa9012881b4393ab4989a200e78647ee3ae3c0d1ff4bb0f80e6b4bb7bd0
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000ac
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
                                                                                                                                                                                                                              • Size 23KB
                                                                                                                                                                                                                              • SHA256 dd05e326cf8eac3b55acecf29c842ed73e6e6dd06491cf47f7e8800680ab3e33
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000ad
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
                                                                                                                                                                                                                              • Size 316KB
                                                                                                                                                                                                                              • SHA256 5ae3965ae20c8090af12aeafec6882ef41829397f28f554e89fbabdf9069ea7e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000ae
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
                                                                                                                                                                                                                              • Size 23KB
                                                                                                                                                                                                                              • SHA256 b0e7558f4710a1e255b93e3deefe3aebb19f3bb41c150f685a74d3b1a1c79e87
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000af
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
                                                                                                                                                                                                                              • Size 149KB
                                                                                                                                                                                                                              • SHA256 bd728d177f1548f4f334d1840c679f8e92191288d45daa4c182cde4f14b42886
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000b0
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
                                                                                                                                                                                                                              • Size 179KB
                                                                                                                                                                                                                              • SHA256 067dfc4c344e1defe745dfe7387da8ad19c006973ecc272f7cf494ff83777276
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000b1
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b1
                                                                                                                                                                                                                              • Size 104KB
                                                                                                                                                                                                                              • SHA256 5e63aacc929084eb45b2a9ce20bccecdad7d99ffd1e9877548f166abe1f9fe6f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000b2
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b2
                                                                                                                                                                                                                              • Size 156KB
                                                                                                                                                                                                                              • SHA256 668c65bbcae0eb9b7293fc95b5f602a69da9522c37491d375179b5a829aecac0
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000b3
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b3
                                                                                                                                                                                                                              • Size 120KB
                                                                                                                                                                                                                              • SHA256 8516c883a5e183bc7621ce5cecff0e0bd4d64d178307b7bdf369bf9617d081bf
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_0000b9
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b9
                                                                                                                                                                                                                              • Size 28KB
                                                                                                                                                                                                                              • SHA256 1dcf355d4a8b1ce7a55c28e1ab9178c4c9bda93b73f0cc4fda9feafbc870751f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 966dfae6115f2fb91b05df69297c3d9eea83cb534aa9404d4e4c6997d15cda88
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 22ab4016ef903e9edfac745d93526cbf779058dc34e3fa0ddbee9679099df094
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 5KB
                                                                                                                                                                                                                              • SHA256 3cbcd8a887fccfa6c48928e74e9cfc1d2508bb5568961a592135921f08d8aae2
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 5KB
                                                                                                                                                                                                                              • SHA256 78e0e8a6e80673e6f4f71d474e807630efe15cfeae9b45e39a51e38943fff5b6
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 5KB
                                                                                                                                                                                                                              • SHA256 3ae85fc100afa0eb092951578746e2cf44dba21d3f8b4ca98fb8177934f441f0
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index~RFe595b55.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595b55.TMP
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 b4b15754cc02aa9d1b81f172b931eab7f368f9155c181a9938ade722f9e1712c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Edge Profile.ico
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                              • Size 70KB
                                                                                                                                                                                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                              • Size 15KB
                                                                                                                                                                                                                              • SHA256 3d868bd5a0d03787eeb1cf4fe850203b22b0b0728230eed517e23f3c490dc10e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                              • Size 111B
                                                                                                                                                                                                                              • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                              • Size 13KB
                                                                                                                                                                                                                              • SHA256 d2476e598ccd4e75518b81861c0153f09f0600b3a9d849bf1525d1b0f0799d1e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                              • Size 14KB
                                                                                                                                                                                                                              • SHA256 218b4ee5497674a5280349d018b8706fea43cd489a4fedb40eee3174b687f5e5
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                                                              • SHA256 761a07c0fd2d6780cfd3686a51b3934ac22dcd42974044732588c858a6f8baca
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                                                              • SHA256 10c72712aef6e59b1f995e13beb448cb4843ece56ca47710260a4146bc49e907
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                                                              • SHA256 22daaf141b62064fb06ffbffaea55e47ff4be90b78d7583040defeeba9964e7f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                              • Size 13KB
                                                                                                                                                                                                                              • SHA256 64bd7135f18fb3205f31f7a047481fb67c295456148c1e08ee6ba33f90b3ddef
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Secure Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                              • Size 35KB
                                                                                                                                                                                                                              • SHA256 6a792bc4f35733184c394394db1b508b1880cc2f93f362efdc01074c375d5dc0
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 4b7eb9afa700babad51181465998897b276c162e7255429ed8b102d334e2d142
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index~RFe5d83f8.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe5d83f8.TMP
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 b17aa1f1f8dff80c54cea8e5519e244763a06372fe21aa9405672562759616a4
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              index.txt
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                                              • Size 371B
                                                                                                                                                                                                                              • SHA256 3319048a0f730357f67d8f7d0281a1798a3fcf46126314250571ea27d348da1b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              00000000
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\FileSystem\t\00\00000000
                                                                                                                                                                                                                              • Size 1B
                                                                                                                                                                                                                              • SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              48d1800b-0a6b-4331-bac7-8cb96c2efef8.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\48d1800b-0a6b-4331-bac7-8cb96c2efef8.tmp
                                                                                                                                                                                                                              • Size 22KB
                                                                                                                                                                                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              office_endpoints_list.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
                                                                                                                                                                                                                              • Size 9KB
                                                                                                                                                                                                                              • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 18KB
                                                                                                                                                                                                                              • SHA256 fa70b3668d54fcb48bbfc433a72f8465bbf28e49bea69cabd6c82a86fb925c0d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 29KB
                                                                                                                                                                                                                              • SHA256 3909591d61134b653095e9959690b3809cba5d4519763ac3f53e6b62d41e4556
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 18KB
                                                                                                                                                                                                                              • SHA256 8da08e9823522283d03383d9d3bcec4fd182cd118bbd9185ce47e3d8946c9ea5
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 18KB
                                                                                                                                                                                                                              • SHA256 ed0ace3d62fd562ac9bf099d0b152c5dbfd46a17cc81690da24cd32fb36f896c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 29KB
                                                                                                                                                                                                                              • SHA256 e3cb503b9996f669697a61616df893610a1c241645a26217ddd6402541deb80c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 29KB
                                                                                                                                                                                                                              • SHA256 f2b530062648fe93e4d003c7c3f04a3216a6bfb081477cf9da83e257718cb70b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 29KB
                                                                                                                                                                                                                              • SHA256 fd29fa06da3d7ef8a6d0a8da5c8806d34dac816c2a52da6f20875398f7966d06
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 29KB
                                                                                                                                                                                                                              • SHA256 7d38a237b61d131546f1fe71f0b52b032f0973c7827fbdee4bdb54552abee232
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                              • SHA256 18aa8ae1964c78801c0c38c2fee4607b0b6cd32051d7d7848de83cf90d467407
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 29KB
                                                                                                                                                                                                                              • SHA256 31fe3d71a091a7002155f7700572cb319937e4074688d4feb759b6b4cfed5053
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                              • SHA256 dc833aaac92c6014f2a5140a5f688def42ba9812fda8e2622712ece937d81f75
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 29KB
                                                                                                                                                                                                                              • SHA256 017ce4451218651e822e9cbbea07e2f7e1fc898ba85d71f3960bdc430565d61e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                              • Size 392B
                                                                                                                                                                                                                              • SHA256 4245a374b077183c56acba91e927e569efac0eab45af91589d7c6ad8fe9da8c2
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                              • Size 392B
                                                                                                                                                                                                                              • SHA256 6d1dcb0f2c7a2f15425fe1dcd541749b7d719116e0318a2e773dae73143e0de0
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                              • Size 392B
                                                                                                                                                                                                                              • SHA256 94b8dde8356d0258e41a18006d4361d0ac82cb43746cde8265866594ff6f274b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                              • Size 392B
                                                                                                                                                                                                                              • SHA256 f7b38f6ec57dce095b7ba12bb95cda5c901322ebcaaec4a17979f9ceee1a1e0e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                              • Size 392B
                                                                                                                                                                                                                              • SHA256 fbe7285f0e4924dbe08699e27d2ce945500985a1aebffdc64e4b602850c5d2c5
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                              • Size 392B
                                                                                                                                                                                                                              • SHA256 ebff4532e07222eaea6588d3463790898d0ffc9efd694b4955215ad27c984174
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                              • Size 392B
                                                                                                                                                                                                                              • SHA256 25767b871c4cfa0ae4d6318742690b555e522cc64633540c5c256a9327997acf
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                              • Size 392B
                                                                                                                                                                                                                              • SHA256 92781411a49eb089afd9ab7e46ae29ca118347f56ec1e9e312b990d0804cb0ca
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                              • Size 392B
                                                                                                                                                                                                                              • SHA256 c669353c584c5e658fb1d959d5887c6566e089c1c58c236e9e8cfe57a3aa4607
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              RevisitationBloomfilter~RFe5ae2ff.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5ae2ff.TMP
                                                                                                                                                                                                                              • Size 392B
                                                                                                                                                                                                                              • SHA256 544cbe8edb9928d8ada58ce7a4599100083e6b284984ed508880fae12b68468c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              keys.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                              • SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              nav_config.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 132B
                                                                                                                                                                                                                              • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 372B
                                                                                                                                                                                                                              • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 252B
                                                                                                                                                                                                                              • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 612B
                                                                                                                                                                                                                              • SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 492B
                                                                                                                                                                                                                              • SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 732B
                                                                                                                                                                                                                              • SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 852B
                                                                                                                                                                                                                              • SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 972B
                                                                                                                                                                                                                              • SHA256 4d2b47e594a4d5d9d0c079c2ff5fac0e47e26ffad46c371ad51e472b3dcd0669
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              323129a7-6d1b-4728-8427-5e9946d3e351.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\323129a7-6d1b-4728-8427-5e9946d3e351.tmp
                                                                                                                                                                                                                              • Size 13B
                                                                                                                                                                                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              custom_partner_content.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.67\resources\custom_partner_content.json
                                                                                                                                                                                                                              • Size 245KB
                                                                                                                                                                                                                              • SHA256 84bc1efb211c6b45f2906278a36f1414922f994a9611bbee7713ffd4ae21e967
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              assistant_installer.exe
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                                                                                                                                                                                                                              • Size 2.4MB
                                                                                                                                                                                                                              • SHA256 c5eef147beda944c8bff63591165b4c49e556d2c45c6ea9b9f1d9e16f180621e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              opera.exe
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                              • Size 2.9MB
                                                                                                                                                                                                                              • SHA256 07419e4de7dbcd54e137e00a1d1f2fb7cc7036dbda59d585f867535b1034b9aa
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Opera GX Browser.lnk
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\opera_package_202608302342291\Opera GX Browser.lnk
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 8561f5048f7f55f1e9f3442a167cfa36088f81605a49170cfc34622b49960c13
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              additional_file0.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\opera_package_202608302342291\additional_file0.tmp
                                                                                                                                                                                                                              • Size 2.8MB
                                                                                                                                                                                                                              • SHA256 70f1b1cbe5162fd8842c441779ef4d59de6b182d1448fc6285c6a73ae3033fc4
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              installer_prefs_include.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\opera_package_202608302342291\installer_prefs_include.json
                                                                                                                                                                                                                              • Size 796B
                                                                                                                                                                                                                              • SHA256 979b4aaa588505971e40ac0308dee5aa26011b0f9f8f317a8dee1fbd9212569c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              installer_prefs_include.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\opera_package_202608302342291\installer_prefs_include.json
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 f31b5aa2f30c729e4cb3869da4ebdcb57566bc4781c09721669852c29a702a96
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              installer_prefs_include.json.backup
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\opera_package_202608302342291\installer_prefs_include.json.backup
                                                                                                                                                                                                                              • Size 781B
                                                                                                                                                                                                                              • SHA256 77f93d0b5d477f1ca2aa9ddd3fac49fcb5dca16e5bef3a31d77ab35fb0e5690a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              pref_default_overrides
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\.opera\42764630-4967-40e8-bf5e-a790427eac37 Opera GX Installer Temp\opera_package_202608302342291\pref_default_overrides
                                                                                                                                                                                                                              • Size 2B
                                                                                                                                                                                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              37658ff3-2f38-45b5-b8f2-8846f589d842.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\37658ff3-2f38-45b5-b8f2-8846f589d842.tmp
                                                                                                                                                                                                                              • Size 1B
                                                                                                                                                                                                                              • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              installer.exe
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC96CB30B\installer.exe
                                                                                                                                                                                                                              • Size 9.1MB
                                                                                                                                                                                                                              • SHA256 ce0afbd8f8cd1a36958b3d0bc8aa78e8c99c7861bab067a67821f77728be608d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              _elementtree.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_elementtree.pyd
                                                                                                                                                                                                                              • Size 133KB
                                                                                                                                                                                                                              • SHA256 58339737dd818a6d0bac98403158677f2f7d54adc7c673b9a8a18c8b19ab11f6
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              app.yaml
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\app.yaml
                                                                                                                                                                                                                              • Size 55B
                                                                                                                                                                                                                              • SHA256 577c75fe4528bd579f6abba8cc1517c166abe2021074415e7c5e66172b23fd82
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              cacert.pem
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem
                                                                                                                                                                                                                              • Size 264KB
                                                                                                                                                                                                                              • SHA256 4f3975ff30abbf35443b486064ae8bcb41dff707ffdf576c76d292fb458aa0a9
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              libffi-8.dll
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll
                                                                                                                                                                                                                              • Size 38KB
                                                                                                                                                                                                                              • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              _sodium.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\nacl\_sodium.pyd
                                                                                                                                                                                                                              • Size 396KB
                                                                                                                                                                                                                              • SHA256 24a40fcaeb58aae4b4e14c2866b3cbab9598ce0e0c01004914f7ff5d0850549b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              _pydantic_core.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pydantic_core\_pydantic_core.pyd
                                                                                                                                                                                                                              • Size 5.1MB
                                                                                                                                                                                                                              • SHA256 9d7e5073e51a4d88dbb8902b273b99edaf36a6dac2e32b53d93d30118df5a193
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ext_mod.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pytauri_wheel\ext_mod.pyd
                                                                                                                                                                                                                              • Size 28.5MB
                                                                                                                                                                                                                              • SHA256 f2bf81a75253d16168ed3624205873e634c03789e58639632ba4e93608f15bf3
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              unicodedata.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd
                                                                                                                                                                                                                              • Size 695KB
                                                                                                                                                                                                                              • SHA256 1989628f16052f9123c5cf603e96490a75fde6228315457556f96a838bf9e904
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              _yaml.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\yaml\_yaml.pyd
                                                                                                                                                                                                                              • Size 257KB
                                                                                                                                                                                                                              • SHA256 fe21a55b82fb7b11d0c5f8c58bcb91675143d9cbcc2c6667501f7b6f7b0f9f68
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              e1689d36-0ef2-48d6-a7b7-be39fe00365f.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e1689d36-0ef2-48d6-a7b7-be39fe00365f.tmp
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              _bz2.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\_bz2.pyd
                                                                                                                                                                                                                              • Size 84KB
                                                                                                                                                                                                                              • SHA256 b3dd7cea6d03342252834cebcc814af37d850b86d0627fa22b7f6990882f2f8b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              _cffi_backend.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\_cffi_backend.pyd
                                                                                                                                                                                                                              • Size 175KB
                                                                                                                                                                                                                              • SHA256 0e3d149b91fc7dc3367ab94620a5e13af6e419f423b31d4800c381468cb8ad85
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              _ctypes.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\_ctypes.pyd
                                                                                                                                                                                                                              • Size 130KB
                                                                                                                                                                                                                              • SHA256 dfa65498c77e71f038883337d2b5ffd92508489e79e6ee5e96ddec4ecf2a7fa1
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              _decimal.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\_decimal.pyd
                                                                                                                                                                                                                              • Size 276KB
                                                                                                                                                                                                                              • SHA256 f55d81378a3261a7073fb71aee674152265b6f24ba6f375f9b939d5a117d8e6b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              _hashlib.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\_hashlib.pyd
                                                                                                                                                                                                                              • Size 67KB
                                                                                                                                                                                                                              • SHA256 1a3010b06c2fcd625dece3dd0883ca060e98b94adc062b06cb1a671cfc3b5caf
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              _lzma.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\_lzma.pyd
                                                                                                                                                                                                                              • Size 155KB
                                                                                                                                                                                                                              • SHA256 f20be6a9fee8fb5d53170c4bc24a39b48d3c0ccbe8e2000e60ff7d65b77c6ea1
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              _queue.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\_queue.pyd
                                                                                                                                                                                                                              • Size 34KB
                                                                                                                                                                                                                              • SHA256 1e349a13913370369059a4ae5951157112b5eba53ed4389c18ffc5e00af1a037
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              _socket.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\_socket.pyd
                                                                                                                                                                                                                              • Size 84KB
                                                                                                                                                                                                                              • SHA256 127a39d2198f17dd9b573904fe7e4040c7c8718753e6c4edee2ff6c35f487fac
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              _ssl.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\_ssl.pyd
                                                                                                                                                                                                                              • Size 177KB
                                                                                                                                                                                                                              • SHA256 faf716d309349dbd54efd7fb402bd42ed21a537614ac0da89ed92ba307ecbf15
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              _uuid.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\_uuid.pyd
                                                                                                                                                                                                                              • Size 27KB
                                                                                                                                                                                                                              • SHA256 6748c182df6181cff8691da72dbb81f4f7f446ac7482d5dfe671f2b5333aed5d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              _wmi.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\_wmi.pyd
                                                                                                                                                                                                                              • Size 38KB
                                                                                                                                                                                                                              • SHA256 3be5e14e9a9dc49f099209dee98b9cb5e31ade3b0deab52277026bb14df5bdb6
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              _zoneinfo.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\_zoneinfo.pyd
                                                                                                                                                                                                                              • Size 49KB
                                                                                                                                                                                                                              • SHA256 88f8ce841f21a2203fe7f66fdc95723321f21678916f8cd87f24be370d7e00b3
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              md.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\charset_normalizer\md.pyd
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 76c8700ffc983bbec07468e354039b21e25e49e7c19f43d7343994c90d4bb7bf
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              md__mypyc.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\charset_normalizer\md__mypyc.pyd
                                                                                                                                                                                                                              • Size 122KB
                                                                                                                                                                                                                              • SHA256 e9c308245fe01d33ef92c7026115a0a930fd865fbe1bfcefa91e76c6aa32a0b3
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              libcrypto-3.dll
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\libcrypto-3.dll
                                                                                                                                                                                                                              • Size 5.0MB
                                                                                                                                                                                                                              • SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              libssl-3.dll
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\libssl-3.dll
                                                                                                                                                                                                                              • Size 776KB
                                                                                                                                                                                                                              • SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              pyexpat.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\pyexpat.pyd
                                                                                                                                                                                                                              • Size 201KB
                                                                                                                                                                                                                              • SHA256 719dc29fee125f0d5026319da9a3001c130c84419db7ef7c5473fb496d56cfc2
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              python3.dll
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\python3.dll
                                                                                                                                                                                                                              • Size 70KB
                                                                                                                                                                                                                              • SHA256 4ae581aa4e65fef9f92c84c428c990892da538b4d9289592df51fa31fd879770
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              python313.dll
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\python313.dll
                                                                                                                                                                                                                              • Size 5.8MB
                                                                                                                                                                                                                              • SHA256 41ec4fc4e5bc8b207258590238f7f050b13fdfee84c4a7b1ecff6e945d031a10
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              select.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\select.pyd
                                                                                                                                                                                                                              • Size 32KB
                                                                                                                                                                                                                              • SHA256 9cc1ef0264060099503592db57ee7d7c1f8d6bea689b2ed125919c7a30b7ab7f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Banjul
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\tzdata\zoneinfo\Africa\Banjul
                                                                                                                                                                                                                              • Size 130B
                                                                                                                                                                                                                              • SHA256 f3e7fcaa0e9840ff4169d3567d8fb5926644848f4963d7acf92320843c5d486e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Djibouti
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\tzdata\zoneinfo\Africa\Djibouti
                                                                                                                                                                                                                              • Size 191B
                                                                                                                                                                                                                              • SHA256 0783854f52c33ada6b6d2a5d867662f0ae8e15238d2fce7b9ada4f4d319eb466
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Kigali
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\tzdata\zoneinfo\Africa\Kigali
                                                                                                                                                                                                                              • Size 131B
                                                                                                                                                                                                                              • SHA256 910c97c091cd34ae7427c83226234ce7b4f2f425c5822d6669c24be62010a792
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Lagos
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\tzdata\zoneinfo\Africa\Lagos
                                                                                                                                                                                                                              • Size 180B
                                                                                                                                                                                                                              • SHA256 e5ef1288571cc56c5276ca966e1c8a675c6747726d758ecafe7effce6eca7be4
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Curacao
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\tzdata\zoneinfo\America\Curacao
                                                                                                                                                                                                                              • Size 177B
                                                                                                                                                                                                                              • SHA256 abbe8628dd5487c889db816ce3a5077bbb47f6bafafeb9411d92d6ef2f70ce8d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Panama
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\tzdata\zoneinfo\America\Panama
                                                                                                                                                                                                                              • Size 149B
                                                                                                                                                                                                                              • SHA256 a78d73067ba3cbd94f8a23dfdd6aa8b68cb33b18484bc17b4e20ea1aec2f0a81
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Toronto
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\tzdata\zoneinfo\America\Toronto
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 815ab4db7a1b1292867d2f924b718e1bba32455ce9f92205db2feb65029c6761
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Shanghai
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\tzdata\zoneinfo\Asia\Shanghai
                                                                                                                                                                                                                              • Size 393B
                                                                                                                                                                                                                              • SHA256 bf8b7ed82fe6e63e6d98f8cea934eeac901cd16aba85eb5755ce3f8b4289ea8a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              UCT
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\tzdata\zoneinfo\Etc\UCT
                                                                                                                                                                                                                              • Size 111B
                                                                                                                                                                                                                              • SHA256 fddce1e648a1732ac29afd9a16151b2973cdf082e7ec0c690f7e42be6b598b93
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Isle_of_Man
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\tzdata\zoneinfo\Europe\Isle_of_Man
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 676541f0b8ad457c744c093f807589adcad909e3fd03f901787d08786eedbd33
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Luxembourg
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\tzdata\zoneinfo\Europe\Luxembourg
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 b10f9542a8509f0a63ebca78e3d80432dd86b8ea296400280febd9cfa76e8288
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Oslo
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\tzdata\zoneinfo\Europe\Oslo
                                                                                                                                                                                                                              • Size 705B
                                                                                                                                                                                                                              • SHA256 a7fd9932d785d4d690900b834c3563c1810c1cf2e01711bcc0926af6c0767cb7
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Skopje
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\tzdata\zoneinfo\Europe\Skopje
                                                                                                                                                                                                                              • Size 478B
                                                                                                                                                                                                                              • SHA256 a8c964f3eaa7a209d9a650fb16c68c003e9a5fc62ffbbb10fa849d54fb3662d6
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Greenwich
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\tzdata\zoneinfo\Greenwich
                                                                                                                                                                                                                              • Size 111B
                                                                                                                                                                                                                              • SHA256 dc4a07571b10884e4f4f3450c9d1a1cbf4c03ef53d06ed2e4ea152d9eba5d5d7
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Wallis
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\tzdata\zoneinfo\Pacific\Wallis
                                                                                                                                                                                                                              • Size 134B
                                                                                                                                                                                                                              • SHA256 09035620bd831697a3e9072f82de34cfca5e912d50c8da547739aa2f28fb6d8e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Yap
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\tzdata\zoneinfo\Pacific\Yap
                                                                                                                                                                                                                              • Size 154B
                                                                                                                                                                                                                              • SHA256 683001055b6ef9dc9d88734e0eddd1782f1c3643b7c13a75e9cf8e9052006e19
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Mountain
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\tzdata\zoneinfo\US\Mountain
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 9bb703920eca4b6119e81a105583a4f6ca220651f13b418479ab7cd56c413f3e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              vcruntime140.dll
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\vcruntime140.dll
                                                                                                                                                                                                                              • Size 117KB
                                                                                                                                                                                                                              • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              vcruntime140_1.dll
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\vcruntime140_1.dll
                                                                                                                                                                                                                              • Size 48KB
                                                                                                                                                                                                                              • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              winsound.pyd
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4388_134326031584616402\winsound.pyd
                                                                                                                                                                                                                              • Size 31KB
                                                                                                                                                                                                                              • SHA256 399d8c1a6607a97394a2ed735dcf3b489cf81048e81afe29bce7e0f53fb252c2
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              content_new.js
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4520_496141565\CRX_INSTALL\content_new.js
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              4d337c88-74da-43cd-b946-ad523a70fc7e.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4520_815908255\4d337c88-74da-43cd-b946-ad523a70fc7e.tmp
                                                                                                                                                                                                                              • Size 154KB
                                                                                                                                                                                                                              • SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              protocols.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              crl-set
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
                                                                                                                                                                                                                              • Size 22KB
                                                                                                                                                                                                                              • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                              • SHA256 91152aee45d90e9840f26a6f0953642eae0bef8b098c22e7944ba1ebf8578e31
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_000002
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Cache\Cache_Data\f_000002
                                                                                                                                                                                                                              • Size 47KB
                                                                                                                                                                                                                              • SHA256 3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 48B
                                                                                                                                                                                                                              • SHA256 6a3e53b9303f30a59ec52bc8db5e0de16d34ca95702195df7bc5bcf1442467ed
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 192B
                                                                                                                                                                                                                              • SHA256 c83a3213f4020ac76aadabe6c53f530021ab68c92ccac73779cd1a240c892e73
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              data_0
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\DawnWebGPUCache\data_0
                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                              • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              data_1
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\DawnWebGPUCache\data_1
                                                                                                                                                                                                                              • Size 264KB
                                                                                                                                                                                                                              • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              data_2
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\DawnWebGPUCache\data_2
                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                              • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              data_3
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\DawnWebGPUCache\data_3
                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                              • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              CURRENT
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Extension Scripts\CURRENT
                                                                                                                                                                                                                              • Size 16B
                                                                                                                                                                                                                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              MANIFEST-000001
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Extension State\MANIFEST-000001
                                                                                                                                                                                                                              • Size 41B
                                                                                                                                                                                                                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 440c93999187df642643ff72290e00c06a9e9784e1fba70b9b9a600cfee98a8e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Network Persistent State~RFe599d50.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\Network Persistent State~RFe599d50.TMP
                                                                                                                                                                                                                              • Size 59B
                                                                                                                                                                                                                              • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              SCT Auditing Pending Reports
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                              • Size 2B
                                                                                                                                                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 9e46f1ce62121316b640cff71747966866a8afee751b25a85e9d1b9d6a81341f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 5d2749a12eb02dd04e542c4b0c940ef15b6d0cd5af5e729335529443a2d104f9
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 6789b112993f26df869fe9a460511d1e235506b6a329e4f37c917fb03ffe5d45
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 5ebb96b3af9a10134d677ae5ad357360f4838589167390ce4ef63db84b536763
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 2fa6cb8af429749186334698d1de8f204b2a3c279c3535dab0d2ca45bbbf95a1
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 24d8b5a1e80809e1762e3de1912f026d1abba0414b425814fb5389a9b04afbd7
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 642c271f124af88d9bada77a7279e7efd58242276d161823752c8e097c24e30a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 f81aff43edd7f065e8c489fc91dcaa0a155458571ba1b6af7b84f92529b57d6c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 a48c625dfc795660daec8dbdb41ab8656460b0cfc88a918d399c3d59ee2e1616
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 8461e151dc99be1877e671f155166d5eef28bbd78664e1bb470fad0a6beabe29
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 fcc66e2e36c89605b2764cebe4ee27f08c4321532ac2e30e6b2ef86fa40c3295
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 5887277a6db8e31ec93d4f6b274303ac2e72140bbd1710b4e671ed1f3304d00f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 8e8acf731c10a181b010cf6134d2daf2e4c6c8f2648c763c28cc6e92877913a5
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 50eb8a7a30568bbdf13ec515d973b03c6a21ab1067059c9b7bb84ff884d2eacf
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 d73a3d44983dfa518622d6e0342bd4b7b4ef9a5392fcfab3c2c7ff00a9570ac3
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 8c74f24b9f2cf9939cf28b8c18fc5f94b7f6e3ed238394a2943ed6d1a9fd2825
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 bdf3c3d8ed7827048aed113cc1c9e8e78ea8ee2452e768d013a7f2c5f9da5bbe
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 c6a04fb0944dbb918f45a15c2ab5565b03b8430431896f70ad1b8c9c72421531
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 7b139d7623ed0e88d75b8e26b8d2f0135e282abf2d8aadc4b5014e68f3e51e98
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 bec79af78021548cfd860d49415423626913866007d06f82dab049da1d25c0f7
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 028b21df77cdd5b991ed9a22c7f9e672f8794da28b9d474e1ee437b80962dc6a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 808b552d83e8d031c220f2f844972e133ad013b06b4c603df98b1c65a79d5b0f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 d42f10476ad4aff75dafe409671d1f5c3098256523e780d133d75c403b393d08
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 d5f8ba6338490f96ec48bada6c0f837c304a6869b83efd4c1ab07e2edce8cf49
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 02d19be4c1ba5af31fd1213340352fd4ba0ccfb47785b8b984bcd7eb1a47ac3a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 5f7fb6e446f1a86ae0a2c28eb51a19adf3f412a17489e83f81c0b43fd6f81530
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 8f9b48548d1eed3863cacb373cde9e8d8099d7fa05ea4549685c67c8308a6ecd
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 d82cfc30e560488abadfb44f63fd9f90b888789de4c99b5021f473ae01d04886
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 89585ae0952d3ac31b4577767524ae9b3bc4e511ba9184eb656a1d8d07dbdd32
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 fb3b341ff4a155324b2acd479398ef2f73a53bf3dc8de9f4e6e18e0c70812dbe
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransportSecurity~RFe58ea8a.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Network\TransportSecurity~RFe58ea8a.TMP
                                                                                                                                                                                                                              • Size 523B
                                                                                                                                                                                                                              • SHA256 0daf22e1fa710b2ed6db567a54e93db8b0d0b94a0bb46b8ad65abeeebe20e90b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Preferences
                                                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                                                              • SHA256 81d60e9a601974f54c9bec9b1849e4c6ca484f917869d3c6423881ed58aedd42
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences~RFe5917d4.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Default\Preferences~RFe5917d4.TMP
                                                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                                                              • SHA256 5d46b60edba7eafe914b7bb9fc7995f42f281b458a66bb09869cae484b546c1c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Local State
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 cd12c67c67df78cc89ee3f46c97db49245681c447b8560b032ea4547f4a7c1de
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Local State
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 8052c213acdae9964617fd83e89d2276cd8f959d3831bcb7514ff69248e171cb
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Local State
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 44241c9fbd479896252c9e4dd275ea5d000081933d5470e08262058ba26d8dbe
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Local State
                                                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                                                              • SHA256 091d5a12ebfe09e2771c40a1cafe1ffa79c43ceab6fde4101029c836a77cd3bc
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Local State
                                                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                                                              • SHA256 0b76c9eaa67deaa122381449c1ee36303d6d6f5bd7c76854f793df14aa062469
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Local State
                                                                                                                                                                                                                              • Size 17KB
                                                                                                                                                                                                                              • SHA256 873adbe38a7ecd55eb5a99d801a46bb137f83d2d00914ff85eeb61ebd0fa41b4
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Local State
                                                                                                                                                                                                                              • Size 18KB
                                                                                                                                                                                                                              • SHA256 7e4def6480c8ed2465e3b8c2a6358cf2d790292ccdb108b2cbb672c5a69ad7a1
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Local State
                                                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                                                              • SHA256 b24d466e6d26ec25a1d8c8cd212523849a4fa8f48de62df1583a342892f34fa9
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State~RFe58845e.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Local State~RFe58845e.TMP
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 3d13e644c400b1b5451e758795ecc38fb7d570f691285f492cc63fca3be46b0e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Filtering Rules
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                              • SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              LICENSE
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\com.bloomfisching.app\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
                                                                                                                                                                                                                              • Size 24KB
                                                                                                                                                                                                                              • SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              default.dic
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                                                                                              • Size 2B
                                                                                                                                                                                                                              • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              2a2e0412b8ad04a2.customDestinations-ms
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                              • SHA256 d59699636956684e0be169ba74587dd834d4afa12a69e04e767ca887bba0b150
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              2a2e0412b8ad04a2.customDestinations-ms
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                              • SHA256 119b3fb4b9bacfa3939af42ff9a1b6918ae6c7c20db705319e67227ffaeb2fea
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              3394f451-1e31-4e12-bcce-aba01143fd0e.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\3394f451-1e31-4e12-bcce-aba01143fd0e.tmp
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 4e57a8d10438ffbbe9e550941d38235689822f7bc791b53c2f1658340347f16f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
                                                                                                                                                                                                                              • Size 40B
                                                                                                                                                                                                                              • SHA256 861e2f473ded68cf1e904bc80679ebd118595f554650dcc0ef00fe186af1f2f7
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              0cd3a6dc-0dc9-44f0-96ca-b99f44b70d5c.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\0cd3a6dc-0dc9-44f0-96ca-b99f44b70d5c.tmp
                                                                                                                                                                                                                              • Size 83KB
                                                                                                                                                                                                                              • SHA256 906d8b3a82a914de3b45ca13c71bc97913752f1755099d7cc76582965efef1c8
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              41997d13-8b6e-4df3-8967-fde9a7b25540.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\41997d13-8b6e-4df3-8967-fde9a7b25540.tmp
                                                                                                                                                                                                                              • Size 327B
                                                                                                                                                                                                                              • SHA256 5ac87ee19bf4fd1426d4a7bb42dc3e2c186d01b25579cc58bd5ee355f22d3f24
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              61465ca6-0c4f-477f-9b73-89b75689d4a1.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\61465ca6-0c4f-477f-9b73-89b75689d4a1.tmp
                                                                                                                                                                                                                              • Size 162KB
                                                                                                                                                                                                                              • SHA256 5903c920e584fc5f1e918bd641bf58fd56e8cb20bb68269892a4984ea7538621
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              68b4acfa-3ac3-43ce-8486-82a35e43c7fc.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\68b4acfa-3ac3-43ce-8486-82a35e43c7fc.tmp
                                                                                                                                                                                                                              • Size 171B
                                                                                                                                                                                                                              • SHA256 7ab299e91fd403d624d2ad97ba54ac2756dd6dd711ff36a16358d0f2e7635231
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              93600fad-ac0d-43c1-9328-0513ff90cfa8.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\93600fad-ac0d-43c1-9328-0513ff90cfa8.tmp
                                                                                                                                                                                                                              • Size 20KB
                                                                                                                                                                                                                              • SHA256 95e36d223626b5865142531b74a82b1f0dc462a6838127f1d18f4ee76001ea0b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Bookmarks
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Bookmarks
                                                                                                                                                                                                                              • Size 24KB
                                                                                                                                                                                                                              • SHA256 d25e23d86311d2fa30ea708e56d61818d7188e1e81d226a7c6a31485b05b11eb
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index
                                                                                                                                                                                                                              • Size 24B
                                                                                                                                                                                                                              • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              b12b1432-1772-4003-a3f3-daf769be2fbc.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\b12b1432-1772-4003-a3f3-daf769be2fbc.tmp
                                                                                                                                                                                                                              • Size 48B
                                                                                                                                                                                                                              • SHA256 e0ca0c3d6f3f0ff587bd614299bcb9cfd1b17c8c8688d19f236ddfd1955582d8
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 552B
                                                                                                                                                                                                                              • SHA256 8cf3026d7751a1bc2616da0746966cbf147fa873d75ae9e36daaa96e19f8c4eb
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Network\Network Persistent State
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 499effa578c4594834c3ce020c8b026db3cdfbd59acdb5ba1181fac0bae8646f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences
                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                              • SHA256 2ed7275f7332d9a921ef63c18bd83bb68a2e05578c8dca72ee29f241a292c089
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences
                                                                                                                                                                                                                              • Size 15KB
                                                                                                                                                                                                                              • SHA256 ee88697beb9dde89081b7f9a5e0371fef00deefbac74c696b157c88c8992ca4b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Secure Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Secure Preferences
                                                                                                                                                                                                                              • Size 84KB
                                                                                                                                                                                                                              • SHA256 112ba676b878f620da20a201bf32544be7a72f409eb5b4847dca8500e573e458
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f6784453-09a3-461c-932b-120439c9689b.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\f6784453-09a3-461c-932b-120439c9689b.tmp
                                                                                                                                                                                                                              • Size 72B
                                                                                                                                                                                                                              • SHA256 8dbc2efdf055b4e48bf6a33603fb3757430365e03667bd32ebdb4b82cd5e0971
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 120B
                                                                                                                                                                                                                              • SHA256 9530cf44084ea5272ee0ca608e486fea5226d89f91302ae3df062e7ea7a032f4
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              95edf623-a236-4393-a091-aa2bde23dad1.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\95edf623-a236-4393-a091-aa2bde23dad1.tmp
                                                                                                                                                                                                                              • Size 429B
                                                                                                                                                                                                                              • SHA256 e2743a7a71cfb48b7bc8b812b647dccfc7c4e6c460cdb42a729d9d2f0ed15020
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 541B
                                                                                                                                                                                                                              • SHA256 847b62073a8b63bc983ed3951da454411100703bd199e91084aa89f92b5edf01
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 669B
                                                                                                                                                                                                                              • SHA256 4c223f675781c37667f4bddd21dcc0be7abaf1bb5abaea0d048bac6116948520
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 9225638637997db91cdad634d09d9570ea830cbfbd6aad1116c01a2096b444b3
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 fce92aad9d7566551107bbae92dc9e2179cc51288a0f1c04ddd26fce6d0dc8f3
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 3321352b6a07dd49d81ff46cdf48ab51489bd5ec14e77c7869d6b49125c5dc0f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 1c82d11cb4d32cbfd1765f3db771589ed6ba5d74e3ef7e818e952f6848871c03
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                              • SHA256 5d5eb002bf053b204ec1af6ad3f4c494d3b1fd8f36b8199297930459196316d9
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                              • SHA256 a2f10795e86699c66bbafdaf7cc03d5b957d9c3e2cd1716c0d41d635c8e0c1c7
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 d8c999dce9a91dee0a3dc29b8176602dedeb793114dde138995a6e95bbb37fa9
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 797B
                                                                                                                                                                                                                              • SHA256 8d5cef7e227d8539a46a151d46b1d4ea9d98f7b284b34dccc5fc416592faa7cf
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 1d18019e005c6292d0bccbfa6b0883512e5b49c8e5518495fab3ad3554e28662
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 f34f202d73cd15fc3c57cd1f9dea607642e241670d432ca3c258d6a4265d8e90
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 fde069132f745741ca33ecfe164d1834189a6a378986907fc7fff9e8824a2d0b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 bc965bddb9373ebf4d3e57f288dcc14a23be63972de99e8c1b52abf08ebfc3f7
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 2af02dd0ac17dcb9bf91357db200f858577bf5244311622787aad6ca5a79d075
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 875bc3bbdaffe0358f9bcfeaf752972bfe4ade85ad2ff922c4834165783010b0
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 710da05718a86de2e9433d255c0ce5538d61af4611c85345f381eec989bce446
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 18ef7114bbb68552cc10c4a0a2fab34fab14509e3b2f3a5a1b33f22c3b98ef0e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 9ce3745f92565a3a1f52d8d8051d0b6493089917c3f177977f2bbe0417585988
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 9d32728577b1436e7a60f667bf69775037c58e831ce68fe6b71ccb9c2fb0c432
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 9f9b20d59c91cdebc07688f28c22bf1e3858f6d557ee11d7f357c9836ec5b52c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 700a2bad9f977a55548ff2bf67f2890da74befdbde1ac0cbf585bc957221e517
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                              • SHA256 b8092af0503fc65a0af1601b71cb65e078a8d509c378ca780468148fafc8f32a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                              • SHA256 99c2810731f2f48548240753cdf9e7689d0af2618af6458e9c767d09cd4872a6
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                              • SHA256 276e51e320bb69dcf2c6f8d9e6c04084642b57b1a81e6ddeaae2bedd5e201532
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                              • SHA256 daf00d74c8c24783ae7de1bbc28ce846540bee25671185fe803dee57057e5f65
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 a7f4cae6fdc9d57a2eafc4831246aa159d2d33d755e0022059adce0c7def418d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 973B
                                                                                                                                                                                                                              • SHA256 92369908843d296ff84f6806a5b5745048cf0227072f07f574d6f0df9f41cc3b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 59250cff52ad562d54fcb4ae20018ebe6367d95211f40adad848d8c9705e66ba
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 66eb954d33053e504b75d2e385ae66707e02190d96e2167915a4969659baea65
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 63dd2086595be268aae5c20c8e76c194d0ca6f5c5759a9076e522a4182808492
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 b77e3629378a76acbb96b4108af739737d4c4ae2514956f4c7a9c6a13fce8226
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 fae901b8af1959d0818925fb64f58965928d1f275f6044b599aa1ca99f7d55de
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 213751025d5bfbaf723c826b4af0fe41bb97fce000109b72b1c90b219349c8a3
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 5097c318839d9df11880ec68840ea06e1b7a16700e75b9ea0415978baf34de39
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                              • SHA256 87c580b3470ac5b24588c6a09272d174f053e7ac8f1d9ba08c1c85740f42c51e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                              • SHA256 64b1f733866bb1ecca5cd95acb0463d47aa8aab08584ac951d4c78c9069812cb
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 5630dabe9ff6f54aff12573b672f6738b8b557717ebae0f92ec07ceaf150dd8e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                              • SHA256 056b748324478e97751ddb62512cc46c6d9c783118d928618dbece3e7b21ea56
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                              • SHA256 7a8832b2a5b4311108cb2ff09e18a731ed40132c241a41eab3bf091756914b8b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                              • SHA256 674e93163cb70d97071b45360a16591570edc74b919736ac5d50e2d5dabff76f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 fc34cd624dcddd36ad9cd479dd6dcb6b0d9c62e0484dc0c0c76d57e975f0052c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 9a1202c007f40dc793aa1dbbc99d527c50ef9155b4f78d6c6cb59ea28b391f05
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                              • SHA256 e1ddded20e2d6f1ba93dd4d08c59791088b0024ae4ec36bd3019133f689dd5c3
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 496c2202b332f58ef23e020b265fa33c375020fae4852b3844edc70c6c70a63c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 4e2ec08d26d048d0b89766a5a926d073b7c87929ae9e372e6350974fa24bff9a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                              • SHA256 ec1327e29cad3ba848c6ccd98e8027d2167fbcd0ac343bd44a3d7812b22d132a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                              • SHA256 9d7cf7d09eeec898a85a0f4b87d603bbf63e43c1521ddaf9f7e0cac3233a8610
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                              • SHA256 942d3b4a4420f33651b498e54beefc9e92e2a5c09cb5e7e876fb8dfc22813a95
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                              • SHA256 85bcd7d1d43274512bef3d668f7a2c94acf20886713fefa47acfc4740900da39
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                              • SHA256 254777266640cae68aee2d774b42a78c2d820272e21f634246ffb2d1ea0f8e10
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 96f87b063bd42edbcb9e48896edd62fc1799f4c5212440a86f6cf53f8a9aae93
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 9df3499938971f4179be061b6fb56218808706f7f3ca651b60957bef6aaf1f1a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 2765398bda330222080b85d0c3ed215ac94b84cbdaa438c8288b024d0ac2192f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                              • SHA256 1807e11418bd609d915bdac4fd84638c22c0d0ca5695298fda069b0a222a148d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                              • SHA256 d5e1a3025da4641e765bd79f414acb443c6778c3e8e584bc87be029def55ca49
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 316e6437fb83f87b814874e63607ed0abc1e56ddd6006a85e36ee0d45c6b4bb7
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 cb42e1ce4390b4e56794c762a837f66cf77a6160a8e6d385df709b33e700d283
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                              • SHA256 c60e0ebd20bce3e86dc1440a44707d063f2ba75ee159e822ce7d32eadcd22661
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                              • SHA256 079afcb95d74fd598c0e860c8a9aaae3b31b112ab8f6acaad4f27d01322e52df
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                              • SHA256 dc2ebaba085d06ee13f212592d4dd1b28e3ad83ac6b4db5a9cc5b3ff9eee6697
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 1e123b1451ff8a922be4efcc3254a754c2e7cf9fc512ad19d413dfef00312974
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                              • SHA256 b97184cad5254b4104fbd2767f51c9f8704e45f25bac7320d39c1591b7291496
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_b0a84e6d-42bf-48ff-9264-aa08eacfdc3c.raw
                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                              • SHA256 c6319609caefe5529efdbd504e60e5d2e73e693d4b4d34b7defd404e5a32b17d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              a342b09f-93a6-4a4b-a7a3-3e6cfd30c107.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\a342b09f-93a6-4a4b-a7a3-3e6cfd30c107.tmp
                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                              • SHA256 38fbe5911c68ca93aff9059a7e66778ebbe99aeabaadb9d50cdeda397c6e6e00
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              c7d8fcfb-1cbc-4c76-ab58-f7b0f1fccae7.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\c7d8fcfb-1cbc-4c76-ab58-f7b0f1fccae7.tmp
                                                                                                                                                                                                                              • Size 173B
                                                                                                                                                                                                                              • SHA256 37a89722329894aba18f4ff146fc7532ac6a21eaa6e7f6bfd9dc8da13c444e41
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Size 486B
                                                                                                                                                                                                                              • SHA256 5e5bd9c3aa1cbf781bd84ef8f1bb768b7f46b1433d0c91d407fdc083da9c3460
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 1c550177d6be39b622489261c4c16cbbb131383aef15bd299f15f43debfa9cae
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 1db012297a2f49d03059add3067a5e0901b51b4b73e5784813e59f11daeb0d2b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 19be97ccd308df84c2b7b4fdc2171b70512694de10b4341532c6c905724533f8
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 b7185193ed0b4c32274970c362149123e0d5c641937ff0dfd691a9b138e2ab0f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 422794ecaf6d51c958b46407446c8196634361fc3c6dbb6524e0edb3ea6f2276
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 45813e37364152e0b21e911734567a33167bcbd196904cbf70c61b45ae1ffe0d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 362dd29164b1c9dd3deaeabbda75850d33bbf6a601dea3977c619b4bf764c0ec
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 45ee2b3e112b56f658d05719d36911349d7e0a292f541ea3f885b2c8f23124f8
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Size 388B
                                                                                                                                                                                                                              • SHA256 4e7a4aba56f277c6a545ca1aa6c2fb6ca649875618575b1ae011f3a3458c24ba
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 7973a174c75170c2198396fc93af10859fbd989df93bd967f804bd25aa74af13
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.0.1016429767
                                                                                                                                                                                                                              • Size 548B
                                                                                                                                                                                                                              • SHA256 2ff2cc051edd451da88eaa6ddb131ffd6deefc1b2e49b26e1f99415f88797eea
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 2a55685c24b25edc385b9001b29b637dfcf786bae9c262a3c25195df5d77fe47
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 28f599297a215872db12201952e9d490b8efc803506841774b196f6d8175a3ca
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 285B
                                                                                                                                                                                                                              • SHA256 57b0e42cba788e62751ac02cf3527ac999876d73ec469660c9f6d269c06e2085
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 7cd3584b650a25133ac89e97fe58d6ac5785f1c53760f488ee341983544cec07
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 832ef43e38f6e255b95c133627420c3a0eb15b11aa3b484b890d9ffb83c11fd8
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 b003de141ea07cdb22faa83909737f8f15d86cb05de6caa56d45741f2739a5ec
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 1f136afa1265d9a4cace960c1e430a7ed7bc0da69886c1c0b2047b7c32a3caad
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 0e706e82a3f6d053549111a2d4fb15cff756eb0f573ef5609e176ba649fba188
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 80ede6d5f4b33d780ad378658ea1586cdd521da0519648b7a1e0f849100d0387
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 a71ad97c6a3fa6e63623e3dc921841a26d1541d01b94f5a1083dcf0ec430a060
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 8331c0d9ab019cff75b44e10910ed1ec047d45b81b7f0990eff6ae22cdcc6706
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 d62c49cff724f30cbf41a975faa7ca745e8fae0e740a061c5412929a9c75fc3a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 496B
                                                                                                                                                                                                                              • SHA256 044baac33240617ff13b90e74fafa6d7e38950e5135fc9ecd7008daf50769326
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 7a84451ff3dc7384f85379f74b522fa213ec92097ba264fdba475c9a6c0fbb95
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 8e71a6aadf44df64b103eb494934aef3eede60a97c306b6b42974bcac4d1210a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 403B
                                                                                                                                                                                                                              • SHA256 4ed27500e940680ff5f27da0dd1029c0db21f782c20566c8563420dc829e1e10
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 588B
                                                                                                                                                                                                                              • SHA256 4fa3b6012c0569f938243db544528c70d7f7b70469011f6ba39e5f5d138667b6
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 770B
                                                                                                                                                                                                                              • SHA256 b01c738fbc31c58174a0c172f8eccde20395a6703aaa7a247c676c17ff13f8b3
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 861B
                                                                                                                                                                                                                              • SHA256 1a4c7dba871fbd6bec7d047bb991a2969febb127c505af46f644cd04136e8a37
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 954B
                                                                                                                                                                                                                              • SHA256 4100e25236beaea06ea28d5f7976ca6645e32a44f67b9b79685db4f267a28fb0
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 ca920b3690f180b8d7f4702297881733323c8e2bc55676cd80be4d786a7486d9
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 99985f725d860093479b5b427efa67e65826edae4f375a872b15b830c2a0f35b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 8eeca1c4e1bd4decc11618e246498817c2cd91123fb233090fe04bc7fbc46411
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 966fc30537e7a7fa7d64f17ce80b9468ce88029ae867db8bcc535e9fa5dc04d2
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 6f863aaa1344eadb978b321c1739d2383188a4077a5d18c62735ed95ca131b10
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6140.1.1230799338
                                                                                                                                                                                                                              • Size 681B
                                                                                                                                                                                                                              • SHA256 76553636bb2a11effdbbb6d04e93704318e6724e1f5335f32562e18a73438e8d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Local State
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 e162d07a803b9ef51c3bf1af3d58d2ec7725fda03f947f2197bd21a07f378ffe
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Local State
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 ca762a83d029a13b33e1b5b007f182685982a283a72b0149265da34f691bed18
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              assistant_prefs.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\assistant_prefs.json
                                                                                                                                                                                                                              • Size 151B
                                                                                                                                                                                                                              • SHA256 27de83dad6b2e5af2c3756ac194d67d7a2c3b8d8e4ef91fc71f7afdbbdbc37a4
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f5f841f1-50ec-470b-95f9-a0a3b63e2c4b.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\f5f841f1-50ec-470b-95f9-a0a3b63e2c4b.tmp
                                                                                                                                                                                                                              • Size 151B
                                                                                                                                                                                                                              • SHA256 c43972546a1b4458dd8f1fa10ffabf48f552a8923f4248e519e892e92cfb861a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Current.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\bloomfisching\settings\Current.json
                                                                                                                                                                                                                              • Size 338B
                                                                                                                                                                                                                              • SHA256 9ebd16facdc848ed2235da6e719cc068e857b1ad1dd3bacba5def38388719b95
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              OperaGXSetup.exe
                                                                                                                                                                                                                              • Path C:\Users\Admin\Downloads\OperaGXSetup.exe
                                                                                                                                                                                                                              • Size 3.9MB
                                                                                                                                                                                                                              • SHA256 b4a2aee37d4ec8a0be9c3529d3a37d6ae0945ec17230e31bcf58696877c26bae
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              memory/916-789-0x00007FFE923B0000-0x00007FFE923B1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/3180-1065-0x00000256BFD30000-0x00000256BFD3E000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/4116-894-0x00007FFE923B0000-0x00007FFE923B1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/4680-860-0x00007FFE923B0000-0x00007FFE923B1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/4680-861-0x00007FFE92DF0000-0x00007FFE92DF1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/4936-4984-0x0000017F1F170000-0x0000017F1F8AF000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/6216-2013-0x000001D6AE9D0000-0x000001D6AE9D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/6216-2004-0x000001D6AE9D0000-0x000001D6AE9D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/6216-2005-0x000001D6AE9D0000-0x000001D6AE9D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/6216-2010-0x000001D6AE9D0000-0x000001D6AE9D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/6216-2011-0x000001D6AE9D0000-0x000001D6AE9D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/6216-2012-0x000001D6AE9D0000-0x000001D6AE9D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/6216-2014-0x000001D6AE9D0000-0x000001D6AE9D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/6216-2015-0x000001D6AE9D0000-0x000001D6AE9D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/6216-2016-0x000001D6AE9D0000-0x000001D6AE9D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/6216-2006-0x000001D6AE9D0000-0x000001D6AE9D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/6228-4981-0x0000024A8C250000-0x0000024A8C98F000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/7764-5051-0x00000176FA2E0000-0x00000176FAA1F000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/7772-3650-0x000002393B0B0000-0x000002393B7EF000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/7780-3654-0x000001F578590000-0x000001F578CCF000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/7780-3517-0x00007FFE92610000-0x00007FFE92611000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/7780-3518-0x00007FFE923B0000-0x00007FFE923B1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/7788-3655-0x000002AA6ABF0000-0x000002AA6B32F000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/7796-3651-0x00000167F3360000-0x00000167F3A9F000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/7804-3652-0x00000148D5B00000-0x00000148D623F000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/7812-3653-0x00000218CCE50000-0x00000218CD58F000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/8096-4980-0x000002ABFDA90000-0x000002ABFE1CF000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/9024-4979-0x000002A778A20000-0x000002A77915F000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/9036-4977-0x000002409F180000-0x000002409F8BF000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/9048-4973-0x0000017F08680000-0x0000017F08DBF000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/9052-4983-0x00000141D2F90000-0x00000141D36CF000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/9060-4975-0x0000028836C60000-0x000002883739F000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/9068-4974-0x00000259B7F40000-0x00000259B867F000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/9104-4976-0x000002605C3A0000-0x000002605CADF000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/9188-4978-0x0000017908D60000-0x000001790949F000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/9220-5053-0x000001FEC0800000-0x000001FEC0F3F000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/9288-4982-0x000001F7550D0000-0x000001F75580F000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/9520-5052-0x000001FBAE5C0000-0x000001FBAECFF000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/10004-5055-0x000002556C610000-0x000002556CD4F000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/10080-5056-0x000002147D660000-0x000002147DD9F000-memory.dmp
                                                                                                                                                                                                                              Download