Overview

overview

7

Static

static

1

TLauncher-....6.exe

windows10-ltsc_2021-x64

7

TLauncher-....6.exe

windows11-21h2-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    498s
  • max time network
    502s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260911-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    01/10/2026, 11:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TLauncher-Installer-1.9.7.6.exe
  • Size 59.1MB
  • Sample261001-nqtkrazfnc
  • SHA256 198cb8b4ac93307269d38ee15ef481dcf6b77b57c3a3aa7a6cbebc6195aa1751
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Writes a Windows system DLL name to a user directory 2 TTPs 2 IoCs

    A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

    defense_evasion
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Downloads MZ/PE file 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 30 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Checks computer location settings 2 TTPs 19 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Windows directory 17 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 26 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 11 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 52 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.7.6.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.7.6.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3938314 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.7.6.exe" "__IRCT:3" "__IRTSS:61981678" "__IRSID:S-1-5-21-3202520547-175870679-441661622-1000"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1100
      • C:\Users\Admin\AppData\Local\Temp\TL-INSTALLER.exe
        "C:\Users\Admin\AppData\Local\Temp\TL-INSTALLER.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3096
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:3844106 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TL-INSTALLER.exe" "__IRCT:3" "__IRTSS:3967680" "__IRSID:S-1-5-21-3202520547-175870679-441661622-1000"
          4⤵
          • Downloads MZ/PE file
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2828
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1400
            • C:\Users\Admin\AppData\Local\Temp\7zS87538BB8\installer.exe
              C:\Users\Admin\AppData\Local\Temp\7zS87538BB8\installer.exe --silent --allusers=0 --server-tracking-blob=OWJkNjhmODMyYTkyZWZjMzVhOTM0MTQ5ODFhZTMxNjhkOWQ5ZjJmMmEyZTRhMjgxZjQ0YmJmZjEyNzZmOWRjODp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInRpbWVzdGFtcCI6IjE3OTA4NTQ2NjUuMTc2NSIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgMTAuMCIsInV0bSI6eyJjYW1wYWlnbiI6Ik9wZXJhR1giLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6Ik1TVEwifSwidXVpZCI6ImRkNDg1ZTE1LTY4MWYtNDliMy05OGE2LTBiODQ2YzllZTA4ZiJ9
              6⤵
              • Downloads MZ/PE file
              • Enumerates connected drives
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • Enumerates system info in registry
              • Modifies system certificate store
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1212
              • C:\Users\Admin\AppData\Local\Temp\7zS87538BB8\installer.exe
                C:\Users\Admin\AppData\Local\Temp\7zS87538BB8\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x28c,0x290,0x294,0x26c,0x298,0x7ff7f6bc7998,0x7ff7f6bc79a8,0x7ff7f6bc79b8
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2416
              • C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\installer.exe" --version
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:896
              • C:\Users\Admin\AppData\Local\Temp\7zS87538BB8\installer.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS87538BB8\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1212 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_20261001123749" --session-guid=6bb6c2e3-64a8-4c2a-b4f8-8ef77d62d485 --server-tracking-blob="OTI2NDVmODU3NjhjZTA1OTlhNTEzOTVhMThmOTg1OWUyMmU1YmYwZjUwN2FmZWU3NDc0NGE1NGUwZGY1NmE1ZDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc5MDg1NDY2NS4xNzY1IiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSAxMC4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFHWCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiZGQ0ODVlMTUtNjgxZi00OWIzLTk4YTYtMGI4NDZjOWVlMDhmIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=9408000000000000
                7⤵
                • Enumerates connected drives
                • Executes dropped EXE
                • Enumerates system info in registry
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1588
                • C:\Users\Admin\AppData\Local\Temp\7zS87538BB8\installer.exe
                  C:\Users\Admin\AppData\Local\Temp\7zS87538BB8\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x298,0x29c,0x2a0,0x268,0x2a4,0x7ff7f6bc7998,0x7ff7f6bc79a8,0x7ff7f6bc79b8
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:220
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe" --backend --initial-pid=1212 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491" --session-guid=6bb6c2e3-64a8-4c2a-b4f8-8ef77d62d485 --server-tracking-blob="OTI2NDVmODU3NjhjZTA1OTlhNTEzOTVhMThmOTg1OWUyMmU1YmYwZjUwN2FmZWU3NDc0NGE1NGUwZGY1NmE1ZDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc5MDg1NDY2NS4xNzY1IiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSAxMC4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFHWCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiZGQ0ODVlMTUtNjgxZi00OWIzLTk4YTYtMGI4NDZjOWVlMDhmIn0= " --silent --desktopshortcut=1 --install-subfolder=136.0.6008.76
                  8⤵
                  • Enumerates connected drives
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  • Modifies registry class
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4684
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x7ff6279c7998,0x7ff6279c79a8,0x7ff6279c79b8
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2768
                  • C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491\assistant\assistant_installer.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --copyonly=0 --allusers=0
                    9⤵
                    • Writes a Windows system DLL name to a user directory
                    • Adds Run key to start application
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Enumerates system info in registry
                    • Modifies Internet Explorer settings
                    • Suspicious use of WriteProcessMemory
                    PID:1628
                    • C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491\assistant\assistant_installer.exe
                      "C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x260,0x264,0x268,0x240,0x26c,0x92c9cc,0x92c9d8,0x92c9e4
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:4300
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --run-assistant --allusers=0
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:2628
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0xcec9cc,0xcec9d8,0xcec9e4
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        PID:3792
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe"
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Reads the TCP/IP host and domain name from the registry
                        • System Location Discovery: System Language Discovery
                        • Enumerates system info in registry
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:1336
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Enumerates system info in registry
                          • Suspicious use of WriteProcessMemory
                          PID:2436
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x158,0x160,0x1a4,0x15c,0x194,0x7ffdab5bec30,0x7ffdab5bec40,0x7ffdab5bec50
                            13⤵
                            • Executes dropped EXE
                            PID:2624
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Enumerates system info in registry
                          • Suspicious use of WriteProcessMemory
                          PID:4700
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x19c,0x1a0,0x198,0x168,0x194,0x7ffdab5bec30,0x7ffdab5bec40,0x7ffdab5bec50
                            13⤵
                            • Executes dropped EXE
                            PID:4232
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x284,0x288,0x28c,0x258,0x290,0x937324,0x937330,0x93733c
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1552
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of WriteProcessMemory
                            PID:5132
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x1ac,0x1b0,0x1b4,0x1a8,0x1b8,0x7ffdab5bec30,0x7ffdab5bec40,0x7ffdab5bec50
                              14⤵
                              • Executes dropped EXE
                              PID:5160
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Enumerates system info in registry
                            • Suspicious use of WriteProcessMemory
                            PID:5220
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x16c,0x1a0,0x1a4,0x124,0x19c,0x7ffdab5bec30,0x7ffdab5bec40,0x7ffdab5bec50
                              14⤵
                              • Executes dropped EXE
                              PID:5236
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Enumerates system info in registry
                            • Suspicious use of WriteProcessMemory
                            PID:5296
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x1ac,0x1b0,0x1b4,0x1a8,0x1b8,0x7ffdab5bec30,0x7ffdab5bec40,0x7ffdab5bec50
                              14⤵
                              • Executes dropped EXE
                              PID:5320
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
                    9⤵
                    • Adds Run key to start application
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Reads the TCP/IP host and domain name from the registry
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of WriteProcessMemory
                    PID:3504
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x19c,0x1a0,0x198,0x168,0x194,0x7ffdab5bec30,0x7ffdab5bec40,0x7ffdab5bec50
                      10⤵
                      • Executes dropped EXE
                      PID:4104
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1680,i,18125325398449834796,13659847383749246920,262144 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2060 /prefetch:2
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5584
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=1964,i,10811047006526125076,18093464259905424461,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2164 /prefetch:3
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Reads the TCP/IP host and domain name from the registry
                      • System Time Discovery
                      • Enumerates system info in registry
                      PID:5592
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=2524,i,2023644877733896417,13136410830912497192,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2712 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5668
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=2852,i,9225838017459277943,877823289960423778,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3328 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5804
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=2856,i,14509088669294555170,15730371276607335484,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3348 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5812
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3276,i,917211998187610870,13965602374932759711,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3368 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5820
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3288,i,12876816836812978951,10058881399184168467,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3388 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5828
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3300,i,16499546115677286537,11245852633106727443,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3408 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5836
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3312,i,11948495619031854049,9384526152257554122,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3428 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5844
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4080,i,15883701817450550494,6714945966584868611,2097152 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4120 /prefetch:1
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5900
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_gx_splash.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_gx_splash.exe" --instance-name=61C8973803226C4D4008DEBC18682105EDAB1556896BB924D0EEB1B6C96AB147
                      10⤵
                      • Executes dropped EXE
                      PID:5732
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4728,i,1860053871385440846,5760627102928099146,2097152 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4756 /prefetch:1
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:4592
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4920,i,10509424922153938884,3514371104037852701,2097152 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4936 /prefetch:2
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:1664
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5084,i,5896634094373296309,14121810405110152746,2097152 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5112 /prefetch:1
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6000
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5320,i,9728430975479691688,10471913160488543428,2097152 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5324 /prefetch:1
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:1220
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --asus-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5452,i,18423902200424657910,2690423168105720154,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5456 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      PID:1028
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --corsair-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5460,i,8847771151577354351,10358795377131506781,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5472 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:552
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --logitech-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5464,i,1564340086233184133,13601103936367010998,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5436 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:1192
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --razer-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5468,i,3466989151640145754,15101292192382420932,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5496 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:4728
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6008,i,9676546327911477444,15648703804229405946,2097152 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6020 /prefetch:2
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:3284
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6616,i,8211353864159258097,922460326369823086,2097152 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5844 /prefetch:1
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6280
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=6840,i,15343269211910358940,9040944639631115238,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6872 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6456
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=6912,i,17502246023534606257,11378608664456957645,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7048 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      PID:6604
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7060,i,7960941338061014855,13430445679718423844,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6852 /prefetch:8
                      10⤵
                      • Enumerates system info in registry
                      PID:6612
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7084,i,6904267874583465722,18154353365713942497,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=6580 /prefetch:8
                      10⤵
                      • Enumerates system info in registry
                      PID:6620
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7088,i,5531782007546158888,9006221189336379388,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7096 /prefetch:8
                      10⤵
                      • Enumerates system info in registry
                      PID:6628
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7104,i,3849128763610913778,10273278423410961098,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7124 /prefetch:8
                      10⤵
                      • Enumerates system info in registry
                      PID:6636
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7020,i,16994346891358035041,5687827056698206633,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7152 /prefetch:8
                      10⤵
                      • Enumerates system info in registry
                      PID:6644
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7920,i,12246396982239421415,2944242516240981385,2097152 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7924 /prefetch:2
                      10⤵
                      • Checks computer location settings
                      • Enumerates system info in registry
                      PID:6684
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8084,i,10449680363564157861,9933759607078153217,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8068 /prefetch:8
                      10⤵
                      • Enumerates system info in registry
                      PID:6836
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8256,i,12698309502459652646,84481818483759865,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8268 /prefetch:8
                      10⤵
                      • Enumerates system info in registry
                      PID:6868
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8236,i,3253828066589324996,12382842297073556988,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8232 /prefetch:8
                      10⤵
                      • Enumerates system info in registry
                      PID:6860
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8408,i,15992925581046029104,8575727752858272074,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8404 /prefetch:8
                      10⤵
                        PID:6884
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8560,i,294924506907623179,11983176366619977474,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=7972 /prefetch:8
                        10⤵
                        • Enumerates system info in registry
                        PID:6196
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8884,i,9393315591769850790,17727619526448746954,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8896 /prefetch:8
                        10⤵
                        • Enumerates system info in registry
                        PID:1044
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=9060,i,12390703279782146552,14093913419893262401,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9120 /prefetch:8
                        10⤵
                          PID:7044
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=9292,i,6023217945207178757,13089545515483000309,2097152 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9332 /prefetch:1
                          10⤵
                            PID:6640
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=9340,i,8772530299569184485,15831364206017562775,524288 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=9288 /prefetch:8
                            10⤵
                              PID:6908
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=5308,i,3978765576558136370,15504380559528128013,2097152 --field-trial-handle=2064,i,7823562397047696790,7011981045207808471,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,236579187338894536,11966774056195158531,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=9328 /prefetch:2
                              10⤵
                              • Checks computer location settings
                              PID:7928
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --edition=std-2 --host=https://autoupdate.opera.com/ --installationdatadir="C:\Users\Admin\AppData\Local\Programs\Opera GX" --installdir="C:\Users\Admin\AppData\Local\Programs\Opera GX" --lang=en-US --pipeid --producttype --requesttype=shutdown --version=136.0.6008.76 --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --firstrunver=136.0.6008.76 --firstrunts=1790854727 --consent-info=eyJzdGF0aXN0aWNzX2NvbGxlY3Rpb25fZW5hYmxlZCI6dHJ1ZSwidXNlcl9leHBlcmllbmNlX21ldHJpY3NfcmVwb3J0aW5nX2VuYWJsZWQiOnRydWV9
                              10⤵
                              • Reads the TCP/IP host and domain name from the registry
                              • Enumerates system info in registry
                              PID:7940
                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff7ce096598,0x7ff7ce0965a8,0x7ff7ce0965b8
                                11⤵
                                  PID:7724
                        • C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491\assistant\Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe
                          "C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491\assistant\Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe"
                          7⤵
                          • Writes a Windows system DLL name to a user directory
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:1152
                        • C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491\assistant\assistant_installer.exe
                          "C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491\assistant\assistant_installer.exe" --version
                          7⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Enumerates system info in registry
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:1908
                          • C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491\assistant\assistant_installer.exe
                            "C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x92c9cc,0x92c9d8,0x92c9e4
                            8⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:4800
                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\vc2015_22\vc_redist.x64.exe
                  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\vc2015_22\vc_redist.x64.exe" /passive /norestart
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1332
                  • C:\Windows\Temp\{3647FA01-5388-4ED4-A916-9DA00B5593C6}\.cr\vc_redist.x64.exe
                    "C:\Windows\Temp\{3647FA01-5388-4ED4-A916-9DA00B5593C6}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\vc2015_22\vc_redist.x64.exe" -burn.filehandle.attached=792 -burn.filehandle.self=800 /passive /norestart
                    4⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4316
                    • C:\Windows\Temp\{1AB27FCD-FED9-4FA0-9134-A7423BB5CE7D}\.be\VC_redist.x64.exe
                      "C:\Windows\Temp\{1AB27FCD-FED9-4FA0-9134-A7423BB5CE7D}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{2B827C35-39FC-4AE4-B2A9-FB35A2D24993} {D13DDED8-87C5-4919-B660-4C7AC543FCE3} 4316
                      5⤵
                      • Adds Run key to start application
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:3340
                      • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1300 -burn.embedded BurnPipe.{3CAFED8E-6556-4F1F-BCBB-26553BB0C582} {00B13187-0E26-43A3-86CD-8607A2E27DB3} 3340
                        6⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:4528
                        • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                          "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=656 -burn.filehandle.self=676 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1300 -burn.embedded BurnPipe.{3CAFED8E-6556-4F1F-BCBB-26553BB0C582} {00B13187-0E26-43A3-86CD-8607A2E27DB3} 3340
                          7⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:3660
                          • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                            "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0428DFEE-1955-4D00-B870-E2D005621BF0} {8B8CDB4D-C473-49BF-A9FC-41BB7C7C74D0} 3660
                            8⤵
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:2688
                • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                  "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
                  3⤵
                  • Checks computer location settings
                  • Reads the TCP/IP host and domain name from the registry
                  PID:7028
                  • C:\Windows\SYSTEM32\cmd.exe
                    cmd.exe /c start "" C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                    4⤵
                    • Executes a command shell one-liner
                    PID:5708
                    • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                      C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                      5⤵
                      • Checks computer location settings
                      • Reads the TCP/IP host and domain name from the registry
                      PID:7476
                      • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\bin\java.exe
                        C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\bin\java.exe -Dsun.java2d.uiScale.enabled=false -Xmx1536m -Dfile.encoding=UTF8 -Djava.net.preferIPv4Stack=true --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.desktop/java.awt=ALL-UNNAMED --add-opens=java.desktop/sun.awt.image=ALL-UNNAMED --add-opens=java.desktop/sun.java2d=ALL-UNNAMED --add-opens=java.desktop/java.awt.color=ALL-UNNAMED --add-opens=java.desktop/java.awt.image=ALL-UNNAMED --add-opens=java.desktop/com.apple.eawt=ALL-UNNAMED --add-opens=java.base/java.util.regex=ALL-UNNAMED --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.desktop/java.beans=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.network=ALL-UNNAMED --add-opens=javafx.web/javafx.scene.web=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.event=ALL-UNNAMED -cp C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\annotations-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aopalliance-1.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\arns-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\auth-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-query-protocol-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-xml-protocol-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checker-qual-3.12.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checksums-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checksums-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-compress-1.23.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-io-2.11.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-lang3-3.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-1.1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-api-1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-vfs2-2.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\crt-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\desktop-common-util-1.269-java21.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\DiscordIPC-0.5.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\dnsjava-2.1.8.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\endpoints-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\error_prone_annotations-2.18.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\eventstream-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\failureaccess-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\filters-2.0.235.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\gson-2.13.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guava-31.0.1-jre.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-assistedinject-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-aws-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-aws-eventstream-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-client-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-download-1.269-java21.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpclient5-5.6.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpclient5-fluent-5.6.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpcore5-5.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpcore5-h2-5.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\identity-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\j2objc-annotations-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jackson-annotations-2.13.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jakarta.inject-api-2.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\java-image-scaling-0.8.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javax.annotation-api-1.3.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-api-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-core-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-impl-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jcl-over-slf4j-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-20230227.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-utils-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jsr305-3.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-native-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junrar-0.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\log4j-1.2.17.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-classic-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-core-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\lombok-1.18.30.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-api-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svn-commons-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svnexe-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\metrics-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\MinecraftServerPing-1.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\mockserver-netty-no-dependencies-5.14.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\modpack-dto-2.283.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\picture-bundle-3.73.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\plexus-utils-1.5.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\profiles-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\protocol-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\reactive-streams-1.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regexp-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regions-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\retries-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\retries-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\s3-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\sdk-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\skin-api-1.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\slf4j-api-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\statistics-dto-1.73.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\third-party-jackson-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\tlauncher-resource-1.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\utils-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\utils-lite-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\xz-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\original-TLauncher-2.9378.jar; org.tlauncher.tlauncher.rmo.TLauncher -starterConfig=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\starter.json -requireUpdate=false -currentAppVersion=2.9378 -starterDomainAvailabilityV1=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\domainAvailabilityV1.json -country=${country} -starterJVM= -starterWorkingDirectory=C:\Users\Admin\AppData\Local\Temp -starterJarFile=C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe -starterFileEncoding=UTF-8 -runVersionWithServer=empty
                        6⤵
                        • Checks computer location settings
                        • Reads the TCP/IP host and domain name from the registry
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • System Time Discovery
                        • Checks processor information in registry
                        PID:4996
                        • C:\Windows\SYSTEM32\cmd.exe
                          cmd.exe /C "chcp 437 & wmic CPU get NAME"
                          7⤵
                          • Executes a command shell one-liner
                          PID:2688
                          • C:\Windows\system32\chcp.com
                            chcp 437
                            8⤵
                              PID:6832
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic CPU get NAME
                              8⤵
                              • Reads the TCP/IP host and domain name from the registry
                              • Suspicious behavior: EnumeratesProcesses
                              PID:7804
                          • C:\Windows\SYSTEM32\cmd.exe
                            cmd.exe /C "chcp 437 & cmd.exe /c set processor"
                            7⤵
                            • Executes a command shell one-liner
                            PID:7676
                            • C:\Windows\system32\chcp.com
                              chcp 437
                              8⤵
                                PID:7656
                              • C:\Windows\system32\cmd.exe
                                cmd.exe /c set processor
                                8⤵
                                • Executes a command shell one-liner
                                PID:7612
                            • C:\Windows\SYSTEM32\cmd.exe
                              cmd.exe /C "chcp 437 & dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.tlauncher\logs\tlauncher\dxdiag.txt"
                              7⤵
                              • Executes a command shell one-liner
                              PID:7820
                              • C:\Windows\system32\chcp.com
                                chcp 437
                                8⤵
                                  PID:6664
                                • C:\Windows\system32\dxdiag.exe
                                  dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.tlauncher\logs\tlauncher\dxdiag.txt
                                  8⤵
                                  • Drops file in System32 directory
                                  • Checks SCSI registry key(s)
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1224
                              • C:\Windows\SYSTEM32\cmd.exe
                                cmd.exe /C "chcp 437 & wmic qfe get HotFixID"
                                7⤵
                                • Executes a command shell one-liner
                                PID:2056
                                • C:\Windows\system32\chcp.com
                                  chcp 437
                                  8⤵
                                    PID:7208
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic qfe get HotFixID
                                    8⤵
                                    • Reads the TCP/IP host and domain name from the registry
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:7204
                                • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\bin\javaw.exe
                                  C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\bin\javaw.exe "-Dos.name=Windows 10" -Dos.version=10.0 -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1NewSizePercent=20 -XX:G1ReservePercent=20 -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=32M -Dfml.ignoreInvalidMinecraftCertificates=true -Dfml.ignorePatchDiscrepancies=true -Djava.net.preferIPv4Stack=true -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Xss1M "-Djava.library.path=C:\Users\Admin\AppData\Roaming\.minecraft\versions\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)\natives" "-Djna.tmpdir=C:\Users\Admin\AppData\Roaming\.minecraft\versions\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)\natives" "-Dorg.lwjgl.system.SharedLibraryExtractPath=C:\Users\Admin\AppData\Roaming\.minecraft\versions\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)\natives" "-Dio.netty.native.workdir=C:\Users\Admin\AppData\Roaming\.minecraft\versions\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)\natives" -Dminecraft.launcher.brand=minecraft-launcher -Dminecraft.launcher.version=2.3.173 -cp "C:\Users\Admin\AppData\Roaming\.minecraft\libraries\cpw\mods\securejarhandler\2.1.10\securejarhandler-2.1.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\ow2\asm\asm\9.8\asm-9.8.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\ow2\asm\asm-commons\9.8\asm-commons-9.8.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\ow2\asm\asm-tree\9.8\asm-tree-9.8.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\ow2\asm\asm-util\9.8\asm-util-9.8.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\ow2\asm\asm-analysis\9.8\asm-analysis-9.8.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\minecraftforge\accesstransformers\8.0.4\accesstransformers-8.0.4.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\antlr\antlr4-runtime\4.9.1\antlr4-runtime-4.9.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\minecraftforge\eventbus\6.0.5\eventbus-6.0.5.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\minecraftforge\forgespi\7.0.1\forgespi-7.0.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\minecraftforge\coremods\5.2.4\coremods-5.2.4.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\cpw\mods\modlauncher\10.0.9\modlauncher-10.0.9.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\minecraftforge\unsafe\0.2.0\unsafe-0.2.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\minecraftforge\mergetool\1.1.5\mergetool-1.1.5-api.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\electronwill\night-config\core\3.6.4\core-3.6.4.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\electronwill\night-config\toml\3.6.4\toml-3.6.4.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\maven\maven-artifact\3.8.5\maven-artifact-3.8.5.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\jodah\typetools\0.6.3\typetools-0.6.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\minecrell\terminalconsoleappender\1.2.0\terminalconsoleappender-1.2.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\jline\jline-reader\3.12.1\jline-reader-3.12.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\jline\jline-terminal\3.12.1\jline-terminal-3.12.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\spongepowered\mixin\0.8.5\mixin-0.8.5.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\openjdk\nashorn\nashorn-core\15.4\nashorn-core-15.4.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\minecraftforge\JarJarSelector\0.3.19\JarJarSelector-0.3.19.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\minecraftforge\JarJarMetadata\0.3.19\JarJarMetadata-0.3.19.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\cpw\mods\bootstraplauncher\1.1.2\bootstraplauncher-1.1.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\minecraftforge\JarJarFileSystems\0.3.19\JarJarFileSystems-0.3.19.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\minecraftforge\fmlloader\1.20.1-47.4.10\fmlloader-1.20.1-47.4.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\minecraftforge\fmlearlydisplay\1.20.1-47.4.10\fmlearlydisplay-1.20.1-47.4.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\github\oshi\oshi-core\6.2.2\oshi-core-6.2.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\code\gson\gson\2.10\gson-2.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\failureaccess\1.0.1\failureaccess-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\guava\31.1-jre\guava-31.1-jre.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\ibm\icu\icu4j\71.1\icu4j-71.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\tlauncher\authlib\4.0.43.1\authlib-4.0.43.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\blocklist\1.0.10\blocklist-1.0.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\brigadier\1.1.8\brigadier-1.1.8.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\datafixerupper\6.0.8\datafixerupper-6.0.8.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\logging\1.1.1\logging-1.1.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\tlauncher\patchy\2.2.101\patchy-2.2.101.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\text2speech\1.17.9\text2speech-1.17.9.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-codec\commons-codec\1.15\commons-codec-1.15.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-io\commons-io\2.11.0\commons-io-2.11.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-logging\commons-logging\1.2\commons-logging-1.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-buffer\4.1.82.Final\netty-buffer-4.1.82.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-codec\4.1.82.Final\netty-codec-4.1.82.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-common\4.1.82.Final\netty-common-4.1.82.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-handler\4.1.82.Final\netty-handler-4.1.82.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-resolver\4.1.82.Final\netty-resolver-4.1.82.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-classes-epoll\4.1.82.Final\netty-transport-classes-epoll-4.1.82.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-native-unix-common\4.1.82.Final\netty-transport-native-unix-common-4.1.82.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport\4.1.82.Final\netty-transport-4.1.82.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\it\unimi\dsi\fastutil\8.5.9\fastutil-8.5.9.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\java\dev\jna\jna-platform\5.12.1\jna-platform-5.12.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\java\dev\jna\jna\5.12.1\jna-5.12.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\sf\jopt-simple\jopt-simple\5.0.4\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\commons\commons-compress\1.21\commons-compress-1.21.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\commons\commons-lang3\3.12.0\commons-lang3-3.12.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\httpcomponents\httpclient\4.5.13\httpclient-4.5.13.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\httpcomponents\httpcore\4.4.15\httpcore-4.4.15.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-api\2.19.0\log4j-api-2.19.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-core\2.19.0\log4j-core-2.19.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-slf4j2-impl\2.19.0\log4j-slf4j2-impl-2.19.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\joml\joml\1.10.5\joml-1.10.5.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.1\lwjgl-glfw-3.3.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.1\lwjgl-glfw-3.3.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.1\lwjgl-glfw-3.3.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.1\lwjgl-glfw-3.3.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.1\lwjgl-jemalloc-3.3.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.1\lwjgl-jemalloc-3.3.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.1\lwjgl-jemalloc-3.3.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.1\lwjgl-jemalloc-3.3.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.1\lwjgl-openal-3.3.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.1\lwjgl-openal-3.3.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.1\lwjgl-openal-3.3.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.1\lwjgl-openal-3.3.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.1\lwjgl-opengl-3.3.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.1\lwjgl-opengl-3.3.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.1\lwjgl-opengl-3.3.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.1\lwjgl-opengl-3.3.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.1\lwjgl-stb-3.3.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.1\lwjgl-stb-3.3.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.1\lwjgl-stb-3.3.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.1\lwjgl-stb-3.3.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.1\lwjgl-tinyfd-3.3.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.1\lwjgl-tinyfd-3.3.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.1\lwjgl-tinyfd-3.3.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.1\lwjgl-tinyfd-3.3.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.1\lwjgl-3.3.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.1\lwjgl-3.3.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.1\lwjgl-3.3.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.1\lwjgl-3.3.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\slf4j\slf4j-api\2.0.1\slf4j-api-2.0.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\versions\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world).jar" -Djava.net.preferIPv6Addresses=system "-DignoreList=bootstraplauncher,securejarhandler,asm-commons,asm-util,asm-analysis,asm-tree,asm,JarJarFileSystems,client-extra,fmlcore,javafmllanguage,lowcodelanguage,mclanguage,forge-,Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world).jar" -DmergeModules=jna-5.10.0.jar,jna-platform-5.10.0.jar -DlibraryDirectory=C:\Users\Admin\AppData\Roaming\.minecraft\libraries -p C:\Users\Admin\AppData\Roaming\.minecraft\libraries/cpw/mods/bootstraplauncher/1.1.2/bootstraplauncher-1.1.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries/cpw/mods/securejarhandler/2.1.10/securejarhandler-2.1.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries/org/ow2/asm/asm-commons/9.8/asm-commons-9.8.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries/org/ow2/asm/asm-util/9.8/asm-util-9.8.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries/org/ow2/asm/asm-analysis/9.8/asm-analysis-9.8.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries/org/ow2/asm/asm-tree/9.8/asm-tree-9.8.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries/org/ow2/asm/asm/9.8/asm-9.8.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries/net/minecraftforge/JarJarFileSystems/0.3.19/JarJarFileSystems-0.3.19.jar --add-modules ALL-MODULE-PATH --add-opens java.base/java.util.jar=cpw.mods.securejarhandler --add-opens java.base/java.lang.invoke=cpw.mods.securejarhandler --add-exports java.base/sun.security.util=cpw.mods.securejarhandler --add-exports jdk.naming.dns/com.sun.jndi.dns=java.naming "-Dminecraft.applet.TargetDirectory=C:\Users\Admin\AppData\Roaming\.minecraft\versions\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)" -DlibraryDirectory=C:\Users\Admin\AppData\Roaming\.minecraft\libraries -Dcountry=${country} -Dlog4j.configurationFile=C:\Users\Admin\AppData\Roaming\.minecraft\assets\log_configs\client-1.12.xml "-DLibLoader.modsFolder=C:\Users\Admin\AppData\Roaming\.minecraft\versions\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)\mods" -Xmx10922M cpw.mods.bootstraplauncher.BootstrapLauncher --username wadawdaw --version "Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)" --gameDir "C:\Users\Admin\AppData\Roaming\.minecraft\versions\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)" --assetsDir C:\Users\Admin\AppData\Roaming\.minecraft\assets --assetIndex 5 --uuid 4baa361ac5d841228a6708b3c0b1943d --accessToken null --clientId null --xuid null --userType mojang --versionType release --width 925 --height 530 --launchTarget forgeclient --fml.forgeVersion 47.4.10 --fml.mcVersion 1.20.1 --fml.forgeGroup net.minecraftforge --fml.mcpVersion 20230612.114412
                                  7⤵
                                  • Checks computer location settings
                                  • Reads the TCP/IP host and domain name from the registry
                                  • Checks processor information in registry
                                  PID:4868
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://links.minecraftforge.net/early-display-errors
                                    8⤵
                                      PID:6972
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://links.minecraftforge.net/early-display-errors
                                        9⤵
                                        • Checks processor information in registry
                                        • Modifies registry class
                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:1864
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x258,0x7ffdbb4dc188,0x7ffdbb4dc194,0x7ffdbb4dc1a0
                                          10⤵
                                            PID:1776
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,7438046004891630075,9598002816684780794,524288 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:3
                                            10⤵
                                            • System Time Discovery
                                            PID:5568
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,17744115329104911027,174981919803494793,262144 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:2
                                            10⤵
                                              PID:2480
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,13747302761296634417,5403460747777153825,524288 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:8
                                              10⤵
                                                PID:6608
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,2156537405872766699,3567689312128200886,2097152 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
                                                10⤵
                                                  PID:6768
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,6668465506674336310,11840657789579976904,2097152 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
                                                  10⤵
                                                    PID:8140
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4092,i,4364036044319506821,609643553402411146,2097152 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
                                                    10⤵
                                                      PID:7508
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4108,i,13810946981490363724,2764598887996912687,2097152 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:2
                                                      10⤵
                                                        PID:1360
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,2962232468313902294,8978695927287266566,524288 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
                                                        10⤵
                                                          PID:7640
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,3823171772523782556,1149468665272625110,524288 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
                                                          10⤵
                                                            PID:4328
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,13643469719372306738,367039970771714987,524288 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
                                                            10⤵
                                                              PID:6776
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,16304215698117870500,17561366262409332482,524288 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
                                                              10⤵
                                                                PID:3664
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5912,i,4035248664781254723,15199460402543762614,2097152 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
                                                                10⤵
                                                                  PID:1560
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,18426472736356556618,1671683893637810267,524288 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
                                                                  10⤵
                                                                    PID:6944
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,18426472736356556618,1671683893637810267,524288 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
                                                                    10⤵
                                                                      PID:1888
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,9981491144551264447,3903156096216514457,524288 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
                                                                      10⤵
                                                                        PID:6404
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,6907302391474879672,6650107963516006682,524288 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
                                                                        10⤵
                                                                          PID:5592
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,14186735746287522124,11055435630685880240,524288 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
                                                                          10⤵
                                                                            PID:2072
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,10684400746425069163,11796542260935817434,524288 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
                                                                            10⤵
                                                                              PID:3416
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,14099124254511104863,7816703877104437278,524288 --field-trial-handle=2828,i,17148667495572903706,7533768844036249769,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
                                                                              10⤵
                                                                                PID:5020
                                                            • C:\Windows\system32\vssvc.exe
                                                              C:\Windows\system32\vssvc.exe
                                                              1⤵
                                                              • Checks SCSI registry key(s)
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1864
                                                            • C:\Windows\system32\srtasks.exe
                                                              C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                              1⤵
                                                                PID:4744
                                                              • C:\Windows\system32\msiexec.exe
                                                                C:\Windows\system32\msiexec.exe /V
                                                                1⤵
                                                                • Enumerates connected drives
                                                                • Drops file in System32 directory
                                                                • Drops file in Windows directory
                                                                • Modifies data under HKEY_USERS
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:3768
                                                              • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                                                "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3492
                                                                • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                                                  "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261001123743.log"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3912
                                                                  • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                                                    "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261001123743.log"
                                                                    3⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3728
                                                                    • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                                                      "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{2F316A16-0189-4665-93BC-BC9D64ABE349} {7F966FCA-CB33-4339-8EF6-CBBD3A693C5B} 3728
                                                                      4⤵
                                                                      • Adds Run key to start application
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2436
                                                              • C:\Windows\SysWOW64\DllHost.exe
                                                                C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
                                                                1⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:3104
                                                              • C:\Windows\system32\wbem\unsecapp.exe
                                                                C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                1⤵
                                                                  PID:5548
                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --autostart
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Enumerates system info in registry
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5856
                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x180,0x184,0x17c,0x14c,0x178,0x7ffdab5bec30,0x7ffdab5bec40,0x7ffdab5bec50
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    PID:5476
                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe7FAE56220944838BCDB933E86AD23A432FE91C0ADA84DF94778C72EE141B2B1F
                                                                  1⤵
                                                                    PID:6952
                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x274,0x278,0x27c,0x20c,0x280,0x7ff7ce096598,0x7ff7ce0965a8,0x7ff7ce0965b8
                                                                      2⤵
                                                                        PID:7460
                                                                    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe
                                                                      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding
                                                                      1⤵
                                                                      • Drops file in Windows directory
                                                                      PID:6476
                                                                    • C:\Windows\System32\GameBarPresenceWriter.exe
                                                                      "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                                                                      1⤵
                                                                      • Network Service Discovery
                                                                      PID:7964
                                                                    • C:\Windows\system32\OpenWith.exe
                                                                      C:\Windows\system32\OpenWith.exe -Embedding
                                                                      1⤵
                                                                        PID:5996
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                                                                        1⤵
                                                                        • Drops desktop.ini file(s)
                                                                        • Checks processor information in registry
                                                                        PID:5812
                                                                      • C:\Windows\System32\GameBarPresenceWriter.exe
                                                                        "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                                                                        1⤵
                                                                        • Network Service Discovery
                                                                        PID:6440
                                                                      • C:\Windows\system32\OpenWith.exe
                                                                        C:\Windows\system32\OpenWith.exe -Embedding
                                                                        1⤵
                                                                          PID:6836
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                                                                          1⤵
                                                                          • Checks processor information in registry
                                                                          • Modifies registry class
                                                                          PID:8016
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                          1⤵
                                                                            PID:6624

                                                                          Network

                                                                                MITRE ATT&CK Enterprise v16

                                                                                Reconnaissance

                                                                                Resource Development

                                                                                Initial Access

                                                                                Execution

                                                                                Command and Scripting Interpreter

                                                                                1
                                                                                T1059

                                                                                Windows Command Shell

                                                                                1
                                                                                T1059.003

                                                                                Persistence

                                                                                Boot or Logon Autostart Execution

                                                                                1
                                                                                T1547

                                                                                Registry Run Keys / Startup Folder

                                                                                1
                                                                                T1547.001

                                                                                Event Triggered Execution

                                                                                1
                                                                                T1546

                                                                                Component Object Model Hijacking

                                                                                1
                                                                                T1546.015

                                                                                Hijack Execution Flow

                                                                                1
                                                                                T1574

                                                                                DLL Search Order Hijacking

                                                                                1
                                                                                T1574.001

                                                                                Privilege Escalation

                                                                                Boot or Logon Autostart Execution

                                                                                1
                                                                                T1547

                                                                                Registry Run Keys / Startup Folder

                                                                                1
                                                                                T1547.001

                                                                                Event Triggered Execution

                                                                                1
                                                                                T1546

                                                                                Component Object Model Hijacking

                                                                                1
                                                                                T1546.015

                                                                                Hijack Execution Flow

                                                                                1
                                                                                T1574

                                                                                DLL Search Order Hijacking

                                                                                1
                                                                                T1574.001

                                                                                Defense Evasion

                                                                                Hijack Execution Flow

                                                                                1
                                                                                T1574

                                                                                DLL Search Order Hijacking

                                                                                1
                                                                                T1574.001

                                                                                Masquerading

                                                                                1
                                                                                T1036

                                                                                Match Legitimate Name or Location

                                                                                1
                                                                                T1036.005

                                                                                Modify Registry

                                                                                3
                                                                                T1112

                                                                                Subvert Trust Controls

                                                                                1
                                                                                T1553

                                                                                Install Root Certificate

                                                                                1
                                                                                T1553.004

                                                                                Credential Access

                                                                                Credentials from Password Stores

                                                                                1
                                                                                T1555

                                                                                Credentials from Web Browsers

                                                                                1
                                                                                T1555.003

                                                                                Unsecured Credentials

                                                                                1
                                                                                T1552

                                                                                Credentials In Files

                                                                                1
                                                                                T1552.001

                                                                                Discovery

                                                                                Browser Information Discovery

                                                                                1
                                                                                T1217

                                                                                Network Service Discovery

                                                                                1
                                                                                T1046

                                                                                Network Share Discovery

                                                                                1
                                                                                T1135

                                                                                Peripheral Device Discovery

                                                                                2
                                                                                T1120

                                                                                Query Registry

                                                                                7
                                                                                T1012

                                                                                System Information Discovery

                                                                                6
                                                                                T1082

                                                                                System Location Discovery

                                                                                1
                                                                                T1614

                                                                                System Language Discovery

                                                                                1
                                                                                T1614.001

                                                                                System Network Configuration Discovery

                                                                                2
                                                                                T1016

                                                                                Internet Connection Discovery

                                                                                1
                                                                                T1016.001

                                                                                System Time Discovery

                                                                                1
                                                                                T1124

                                                                                Lateral Movement

                                                                                Collection

                                                                                Data from Local System

                                                                                1
                                                                                T1005

                                                                                Command and Control

                                                                                Exfiltration

                                                                                Impact

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                e596aac.rbs
                                                                                • Path C:\Config.Msi\e596aac.rbs
                                                                                • Size 19KB
                                                                                • SHA256 e583bd786183aba9eb544d765281cb1134afed47590da3baeeab0206396a6158
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                e596ab8.rbs
                                                                                • Path C:\Config.Msi\e596ab8.rbs
                                                                                • Size 19KB
                                                                                • SHA256 c1f5e7b193673a39571034906d2e5dffafddef9a0c7385921c2d09dfbecb4fd4
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                e596abf.rbs
                                                                                • Path C:\Config.Msi\e596abf.rbs
                                                                                • Size 21KB
                                                                                • SHA256 3b80567d7f32e1feb687fafa4d8f89a7999fb89887d0d73d007a1f0af4f49d58
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                e596ace.rbs
                                                                                • Path C:\Config.Msi\e596ace.rbs
                                                                                • Size 21KB
                                                                                • SHA256 c9bc152bb4faee4aa16d9ca0745549afe7d0a0b80e264807ae7fcb285299bf78
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                state.rsm
                                                                                • Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
                                                                                • Size 1024B
                                                                                • SHA256 7fa6a3e8a950fe894529a2a6ba29b05d7d8e5b6bdbf349711f7e7c7f88d8e6e7
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                state.rsm
                                                                                • Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
                                                                                • Size 1004B
                                                                                • SHA256 af5d6f2f7cca9dee82db179233aaf078e42cb45a6c2b8ba02abaf14149509940
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                • Size 471B
                                                                                • SHA256 8b59ffaf49a6819229547efe480edc277295a5645954248da7539380f74cebfa
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                • Size 416B
                                                                                • SHA256 7e1289273a7625d6397300a11cdb4027e983e7169c3877cda0a9b2270e8eb0b7
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                blocklist
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                • Size 105KB
                                                                                • SHA256 6fa1b02b96b249c932f11a4c4f1eb52f042c98bf33d02c325fd422f437c15214
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                settings.dat
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                • Size 280B
                                                                                • SHA256 6e7a1b2aff313d1346d95d5e3a8efc635bcb45e12b921b6caa44f7d2b0a6d934
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                settings.dat
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                • Size 280B
                                                                                • SHA256 de64f2d04fcf5130505abf8f452033663f6c6f34ad6043cda2754984ae410dc7
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                settings.dat
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                • Size 280B
                                                                                • SHA256 0a8fadd19c4d852550ab709595e3c6a88dd1fb68c395a666e1b7eef4147f4efe
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                the-real-index
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                • Size 5KB
                                                                                • SHA256 cbeb173dd0e650903995a596b02f2559e6a3ba0c15edd687e22b854a59a32dbe
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                the-real-index~RFe5fc685.TMP
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5fc685.TMP
                                                                                • Size 3KB
                                                                                • SHA256 e40a8114a77007fca5609220169c83dcf0cca9605a654dcab596b66f5dd7f329
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                Edge Profile.ico
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                • Size 70KB
                                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                MANIFEST-000001
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                                • Size 23B
                                                                                • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                47fd8c56-53d2-4b60-9405-714a11d73869.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\47fd8c56-53d2-4b60-9405-714a11d73869.tmp
                                                                                • Size 2B
                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                Network Persistent State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                • Size 3KB
                                                                                • SHA256 49d1ed09f12ac471a8432d7f4bc415b73ae08b302b3a4931f568de1f4e182362
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                Preferences
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                • Size 12KB
                                                                                • SHA256 31f6d3170e27b46b88872b32438eac8c0057d1973f11e0da6ad91b66d93c9aef
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Preferences
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                • Size 10KB
                                                                                • SHA256 1f06f837e6068a0926e7461948a228b79f1e3ef4abd3b43718e1c9b6f2182507
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Secure Preferences
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                • Size 32KB
                                                                                • SHA256 de45b52a5e297a640fce05120fd5949fab0a119199d5d73bf40faef9a1633846
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                sync_diagnostic.log
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                • Size 4KB
                                                                                • SHA256 ca64e699208f4006ada12a616fdf698fd33b93b7f3c78600932bc6df090c38de
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                ce780f28-b8b2-42b8-bfe2-2fb3bfcc9c78.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ce780f28-b8b2-42b8-bfe2-2fb3bfcc9c78.tmp
                                                                                • Size 6B
                                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                • Size 18KB
                                                                                • SHA256 4717d11900dac09a143bbb17a18c2e1939fcb3c6f37a64ca6aca5aa9060428a2
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                • Size 8KB
                                                                                • SHA256 b24c6037e07fd2d64cc91f07d018504754bdca66820302493fbff5a5fc49a0cd
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                • Size 22KB
                                                                                • SHA256 8117be509d324f0adf5a2eee0f6b7300019cf4cf04330286fcd08cba33529864
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                • Size 8KB
                                                                                • SHA256 7d0ccced1214b32ccc2a18c27b9d4468cafd7cdb4657b9d0b7d6707c6a22a007
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                metadata.json
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                • Size 13B
                                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                136.0.6008.76.manifest
                                                                                • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\136.0.6008.76.manifest
                                                                                • Size 225B
                                                                                • SHA256 9dfc1f09de7f3d585c5b6bbb366e008d38507b8a9bcbc461bfe2a69d9c380629
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                installer.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe
                                                                                • Size 9.2MB
                                                                                • SHA256 cdd0be1bf1c6f5b28085cb391f4a7027725c8f37e20d4319f55835e7dd21c98f
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                +JXF13434691798346323319.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\+JXF13434691798346323319.tmp
                                                                                • Size 141KB
                                                                                • SHA256 b2efabca5ea4bc56eea829713706b5cd0788b82aca153bd4adde9b1573933b4f
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                +JXF16508643159311101210.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\+JXF16508643159311101210.tmp
                                                                                • Size 424KB
                                                                                • SHA256 83ff53f599acefc11f5cf63fd0516d4db72aacf7f0125a5f79c9ff222cbf9dd7
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                +JXF3390958767552520580.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\+JXF3390958767552520580.tmp
                                                                                • Size 477KB
                                                                                • SHA256 a4ece920f221b78d43b550d615c5934db162b64a331ffa663a85199e74ef2e6b
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                +JXF6473370678315004218.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\+JXF6473370678315004218.tmp
                                                                                • Size 132KB
                                                                                • SHA256 9287925cae90ac480804094ff0876832065e2db116470da1f524d79ed9c18b70
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Opera GX Browser.lnk
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491\Opera GX Browser.lnk
                                                                                • Size 1KB
                                                                                • SHA256 1955ca49a88bd1f918e96fe65130e0681b83e9620de3053047a00c82c324ab17
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                additional_file1.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491\additional_file1.tmp
                                                                                • Size 2.9MB
                                                                                • SHA256 cdb600359a2ee392e9ff11e680770171531760b6d64319cf6bffc5c1341a0dc0
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                assistant_installer.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491\assistant\assistant_installer.exe
                                                                                • Size 2.5MB
                                                                                • SHA256 5dda5f3ca9e230e79dc6c74ab74afe8d027cbd4db293ab0260dcf71010f6ff9b
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                dbgcore.dll
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491\assistant\dbgcore.dll
                                                                                • Size 196KB
                                                                                • SHA256 0a08d02dbba60e940694a2c154d4b78969df546d40d8ec314cf6be1753f009d1
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                dbghelp.dll
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491\assistant\dbghelp.dll
                                                                                • Size 1.8MB
                                                                                • SHA256 bb4c23816f445ae5122ba5fc7d8cdd77bb9e519ab107f450320829a98df52175
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                installer_prefs_include.json
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491\installer_prefs_include.json
                                                                                • Size 227B
                                                                                • SHA256 97331f17409895395d817dd6dab7119ff107665a9f866a3c2926bfa9ada6b1b7
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                installer_prefs_include.json
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491\installer_prefs_include.json
                                                                                • Size 242B
                                                                                • SHA256 40ea1fbf69784552a6aca6f03f95b7ec4c38332d39c88322835c70b661d643dd
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                installer_prefs_include.json
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\fb25b02d-f3ea-4ac3-8e59-705c448b5641 Opera GX Installer Temp\opera_package_202610011237491\installer_prefs_include.json
                                                                                • Size 964B
                                                                                • SHA256 2c54a85d5af647d982f47d5687befcf0109e6a91caffe2d839f3fcf982f4bfa8
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                installer.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\7zS87538BB8\installer.exe
                                                                                • Size 9.2MB
                                                                                • SHA256 2511fbf843679b4d8070f3ee4360abab2420ba0dc5f359faecb724e51c6dffe6
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                97f8e82c-8321-468a-b99f-675eb3c29112.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\97f8e82c-8321-468a-b99f-675eb3c29112.tmp
                                                                                • Size 1B
                                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                200.ico
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
                                                                                • Size 116KB
                                                                                • SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                IRIMG1.BMP
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP
                                                                                • Size 12KB
                                                                                • SHA256 1d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                IRIMG1.PNG
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG
                                                                                • Size 45KB
                                                                                • SHA256 4d82d90aa27c7f906f6094c90ad3e185b058efafb9b2c21975b0ea2db76362df
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                IRIMG10.PNG
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG10.PNG
                                                                                • Size 41KB
                                                                                • SHA256 f0cffd9d34649b620d7279b2068e420495079f23f66319e36110360f3e875aa0
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                IRIMG11.PNG
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG11.PNG
                                                                                • Size 43KB
                                                                                • SHA256 b162a410c0cf0c47a5487fd0048311a5c782f83568af85b1f9bb896beb0c22f4
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                IRIMG12.PNG
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG12.PNG
                                                                                • Size 644B
                                                                                • SHA256 b8f5949b393f1c94e522bbed6c4f91bf273ffa23ecae17a3248e822e8b7f6628
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                IRIMG14.PNG
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG14.PNG
                                                                                • Size 40KB
                                                                                • SHA256 7e39befa8fec0b4f6a71cc46b49b2a7aa6819410351b1c9b405f700e857b071f
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                IRIMG2.BMP
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP
                                                                                • Size 12KB
                                                                                • SHA256 9c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                IRIMG3.BMP
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP
                                                                                • Size 12KB
                                                                                • SHA256 4c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                IRIMG3.PNG
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG
                                                                                • Size 475B
                                                                                • SHA256 3642e6bc8cfac59803bbb7a79617886677f496cced89f5746ee5ffc466513e36
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                IRIMG4.BMP
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG4.BMP
                                                                                • Size 451KB
                                                                                • SHA256 64da5bd044908b2c3a725c5a55edec1644be498f41ea05d42a6ae8cd797f1d80
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                IRIMG4.PNG
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG4.PNG
                                                                                • Size 368B
                                                                                • SHA256 ec86b96018d9ef2656af9303c1e9bde952281fe422f0d1596843328b07952d36
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                IRIMG7.PNG
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG7.PNG
                                                                                • Size 438B
                                                                                • SHA256 5252a4f2519c4c215a7d82ee5f2fe5752ed9604fcf5bf90cc98af1448faf881b
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                IRIMG8.PNG
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG8.PNG
                                                                                • Size 206B
                                                                                • SHA256 b8635c896dc08f78667cb30b5bdd1144059bf5e67a2a483fdfbd46ced69a8cdf
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                IRZip.lmd
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
                                                                                • Size 400KB
                                                                                • SHA256 4776d4c121e2294f1e6bca5a89525e4a451190c218244a1e34bcbf9f65b18fa5
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                TL-INSTALLER.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\TL-INSTALLER.exe
                                                                                • Size 3.8MB
                                                                                • SHA256 b6c92b1826f3804c40db9b2adb0350ffc5eec8ce914c6435d0d9b09d34ebad71
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Wow64.lmd
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
                                                                                • Size 252KB
                                                                                • SHA256 27b48727237cd0f8a1205e01e5c93cbe6c7a2f3938faf8d8daa5191094c347a5
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                irsetup.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                                                                • Size 1.7MB
                                                                                • SHA256 81b2e287246cfa5dea40c9589ac32406a4b65f593cae31d65034551399b4be2e
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                lua5.3.dll
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
                                                                                • Size 395KB
                                                                                • SHA256 22eb6f08accb3c20caa7a7240aa094467204918d2a797b5c6905bea3f2361677
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                vc_redist.x64.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\vc2015_22\vc_redist.x64.exe
                                                                                • Size 24.4MB
                                                                                • SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                irsetup.dat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat
                                                                                • Size 141KB
                                                                                • SHA256 4f828417b19fde177b896434400e27898981f5ba8a0fd5ec38723a53a6ea11a8
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                irsetup.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                                                                • Size 1.7MB
                                                                                • SHA256 312a85758f022b0ec26c858f5ef493be5f9bc2ef2f383ccb323d7d4c25261316
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                dd_vcredist_amd64_20261001123743_000_vcRuntimeMinimum_x64.log
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261001123743_000_vcRuntimeMinimum_x64.log
                                                                                • Size 2KB
                                                                                • SHA256 5f43a26f4aee9cc7f06a9b966fee5c3c211e51a02439604261ea7488595cd622
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                dd_vcredist_amd64_20261001123743_001_vcRuntimeAdditional_x64.log
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261001123743_001_vcRuntimeAdditional_x64.log
                                                                                • Size 12KB
                                                                                • SHA256 de58ad3b92844503d500f5a6c1da7f4202fbba41c1fc95376c9f06b79314256b
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                opera-installer-bro.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                                                                • Size 4.0MB
                                                                                • SHA256 77452154677043548ed0694533a72daf94845eee1cb36f046eb3d9c5fa2df151
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                content_new.js
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1864_1708922508\CRX_INSTALL\content_new.js
                                                                                • Size 10KB
                                                                                • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                setuparguments.ini
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
                                                                                • Size 797B
                                                                                • SHA256 57ed0f454c02a1b6d967570d5080de469da148d8fb0cab20053217ee179f0380
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                f69099ace6fe0535a3d1ba03e8d77b969538c227.tlauncherdownload
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\assets\objects\f6\f69099ace6fe0535a3d1ba03e8d77b969538c227.tlauncherdownload
                                                                                • Size 550KB
                                                                                • SHA256 1c6ea6e02b5aa9474b79cc5a56f7f1c28532517a504458c2914edcbd214edc01
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                failureaccess-1.0.1.jar
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\failureaccess\1.0.1\failureaccess-1.0.1.jar
                                                                                • Size 4KB
                                                                                • SHA256 a171ee4c734dd2da837e4b16be9df4661afab72a41adaf31eb84dfdaf936ca26
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                commons-io-2.11.0.jar
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-io\commons-io\2.11.0\commons-io-2.11.0.jar
                                                                                • Size 319KB
                                                                                • SHA256 961b2f6d87dbacc5d54abf45ab7a6e2495f89b75598962d8c723cea9bc210908
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                jopt-simple-5.0.4.jar
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\sf\jopt-simple\jopt-simple\5.0.4\jopt-simple-5.0.4.jar
                                                                                • Size 76KB
                                                                                • SHA256 df26cc58f235f477db07f753ba5a3ab243ebe5789d9f89ecf68dd62ea9a66c28
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                client.jar
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\libraries\v1\objects\0c3ec587af28e5a785c0b4a7b8a30f9a8f78f838\client.jar
                                                                                • Size 22.0MB
                                                                                • SHA256 56b71336d2b4fdffd197f56595b0da93e32a946f78f382a299b8f4b92758bb0f
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                javaw.exe
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\bin\javaw.exe
                                                                                • Size 38KB
                                                                                • SHA256 63597bae5472351392eeecd2230d4180d38297c6019da62cda149db4f7feaa91
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                logging.properties
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\conf\logging.properties
                                                                                • Size 2KB
                                                                                • SHA256 b62d2733ab99556b108a1951d894c5a8d76b1ac7a00c02c388f9eb9be046c56f
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                net.properties
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\conf\net.properties
                                                                                • Size 7KB
                                                                                • SHA256 56dd1f6095c189c1052f6baa32e457efc09de4832e19cdb82bb236dc8abfee9f
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                README.txt
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\conf\security\policy\README.txt
                                                                                • Size 2KB
                                                                                • SHA256 6da0747334b0fea7592fd92614b2bbc8b126535e129b1fee483774d914e98eb5
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                default_local.policy
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\conf\security\policy\limited\default_local.policy
                                                                                • Size 647B
                                                                                • SHA256 2b2627548e61316150d47ffc3e6cad465ca05b3cccd4785eb7d21aa7baa0f441
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                exempt_local.policy
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\conf\security\policy\limited\exempt_local.policy
                                                                                • Size 566B
                                                                                • SHA256 8c3d7648abcd95a272ce12db870082937f4d7f6878d730d83cb7fbb31eb8b2c9
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                default_US_export.policy.tlauncherdownload
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\conf\security\policy\unlimited\default_US_export.policy.tlauncherdownload
                                                                                • Size 146B
                                                                                • SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                default_local.policy
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\conf\security\policy\unlimited\default_local.policy
                                                                                • Size 193B
                                                                                • SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                sound.properties
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\conf\sound.properties
                                                                                • Size 1KB
                                                                                • SHA256 299c2360b6155eb28990ec49cd21753f97e43442fe8fab03e04f3e213df43a66
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ADDITIONAL_LICENSE_INFO
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\legal\java.base\ADDITIONAL_LICENSE_INFO
                                                                                • Size 2KB
                                                                                • SHA256 a69bce275ba7a3570af6579cb0f55682cd75fedfcd49e0e8e9022270c447c916
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ASSEMBLY_EXCEPTION
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\legal\java.base\ASSEMBLY_EXCEPTION
                                                                                • Size 1KB
                                                                                • SHA256 a44eb7b5caf5534c6ef536b21edb40b4d6babf91bf97d9d45596868618b2c6fb
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                LICENSE
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\legal\java.base\LICENSE
                                                                                • Size 18KB
                                                                                • SHA256 4b9abebc4338048a7c2dc184e9f800deb349366bdf28eb23c2677a77b4c87726
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                aes.md
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\legal\java.base\aes.md
                                                                                • Size 1KB
                                                                                • SHA256 45c6d4da48325edfbff3dcf71c704e504c057904435ed23c6d57046d551eb69d
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                c-libutl.md
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\legal\java.base\c-libutl.md
                                                                                • Size 1KB
                                                                                • SHA256 bef40679922d6fdfb7e4ddb223ad6722300f6054ba737bbf6188d60fcec517f9
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                siphash.md
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\legal\java.base\siphash.md
                                                                                • Size 8KB
                                                                                • SHA256 5a792b5a74ad2a5f3d6a7ad8b7a841116e58a772c18bc6e392320a365b222c76
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                wepoll.md
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\legal\java.base\wepoll.md
                                                                                • Size 1KB
                                                                                • SHA256 3ac2992770080453b98c42afa807ba4b2c1738ef756b92a55c645f55e7df48f0
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                zlib.md
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\legal\java.base\zlib.md
                                                                                • Size 1010B
                                                                                • SHA256 809b62ba648e02302f7d9ea6b6886c10d5253ac86ad528038a50c73eada5fce2
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ADDITIONAL_LICENSE_INFO.tlauncherdownload
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\legal\java.desktop\ADDITIONAL_LICENSE_INFO.tlauncherdownload
                                                                                • Size 48B
                                                                                • SHA256 d255311b0a181e243de326d111502a8b1dc7277b534a295a8340ab5230e74c83
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                ASSEMBLY_EXCEPTION.tlauncherdownload
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\legal\java.desktop\ASSEMBLY_EXCEPTION.tlauncherdownload
                                                                                • Size 43B
                                                                                • SHA256 7901499314e881a978d80a31970f0daec92d4995f3305e31fb53c38d9cc6ec3b
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                colorimaging.md
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\legal\java.desktop\colorimaging.md
                                                                                • Size 167B
                                                                                • SHA256 04d61e3e8e71dd452ebe52008af5378d9f6640d14578aeb515dc5375973b0189
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                giflib.md
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\legal\java.desktop\giflib.md
                                                                                • Size 1KB
                                                                                • SHA256 6cd971730d3047ea57f6865b7bdca2509a9876ae24d5c0ed0c4e32def5f9107e
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                mesa3d.md
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\legal\java.desktop\mesa3d.md
                                                                                • Size 5KB
                                                                                • SHA256 63f4e6f75caebbccb95d903fb43e46ac7111b3624d0a34f146b276d7d9e7b152
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                LICENSE.tlauncherdownload
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\legal\java.management.rmi\LICENSE.tlauncherdownload
                                                                                • Size 32B
                                                                                • SHA256 d60635c89c9f352ae1e66ef414344f290f5b5f7ce5c23d9633d41fde0909df80
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                dom.md
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\legal\java.xml\dom.md
                                                                                • Size 3KB
                                                                                • SHA256 6686e8877667584a3a7c07344baadca1a03e29f677162d87c3c0811e990d1148
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                jcup.md
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\legal\java.xml\jcup.md
                                                                                • Size 1KB
                                                                                • SHA256 8d5dcfdf50455a3c34c753a98f21e953248af200415a9084e3f102cb6c43b8bf
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                pkcs11cryptotoken.md
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\legal\jdk.crypto.cryptoki\pkcs11cryptotoken.md
                                                                                • Size 3KB
                                                                                • SHA256 1f36ff1342a581142c858f90064e20633d43529ac82adb85345bd902a14e18b2
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                pkcs11wrapper.md
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\legal\jdk.crypto.cryptoki\pkcs11wrapper.md
                                                                                • Size 2KB
                                                                                • SHA256 371974b1fca3744a3892c7ee1fcc593b8b4281fc218f4cafd2f709e9df5fd81d
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                jvm.cfg
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\lib\jvm.cfg
                                                                                • Size 29B
                                                                                • SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                blocked.certs
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\lib\security\blocked.certs
                                                                                • Size 2KB
                                                                                • SHA256 583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                public_suffix_list.dat
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\lib\security\public_suffix_list.dat
                                                                                • Size 224KB
                                                                                • SHA256 3a2e10e573625dab5489812711b874c05a115ac2471bf90776e45561e8f52e8a
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                tzmappings
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\lib\tzmappings
                                                                                • Size 21KB
                                                                                • SHA256 36dc51c4bf787f640a4b45cbb84ab6954f6e595cbd3617c2f5a4e1e607b38bff
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Real%20realistic%20world%20(realistic)%20(realistic%20world).zip
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)\Real%20realistic%20world%20(realistic)%20(realistic%20world).zip
                                                                                • Size 12.3MB
                                                                                • SHA256 577b6ac684845bada52583d69d47fa402f5e896f0b16bd7e2771cfe22caad90e
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                TLauncherAdditional.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)\TLauncherAdditional.json
                                                                                • Size 66KB
                                                                                • SHA256 2eb1ee1b646e43f804bf4e49d05503f78a1df584464b319714c51c507110f9ba
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                frilled_shark_spawns.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)\config\alexsmobs\frilled_shark_spawns.json
                                                                                • Size 146B
                                                                                • SHA256 7e7b175c33aed22c3d2cd31e215c6243e3790b07a3664b42d130a8f3b897489f
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                jerboa_spawns.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)\config\alexsmobs\jerboa_spawns.json
                                                                                • Size 1KB
                                                                                • SHA256 c4b2ef89d9ad5c4dffcebb51209837da430b166c5767c1a38d90911c4445b124
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                leafcutter_anthill_spawns.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)\config\alexsmobs\leafcutter_anthill_spawns.json
                                                                                • Size 1KB
                                                                                • SHA256 f65e31155b2f2e033bed66dc5ec2ce7f6962be3389369ff800b69dfdecb5d990
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                username-cache.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)\config\voicechat\username-cache.json
                                                                                • Size 2B
                                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                glfw.dll
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)\natives\glfw.dll
                                                                                • Size 357KB
                                                                                • SHA256 f61949c469c54a5f4e5a8e1668255b919ee1237f1e568acf4127dda0abcdc9a8
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                lwjgl.dll
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)\natives\lwjgl.dll
                                                                                • Size 446KB
                                                                                • SHA256 1cbc8a197aea7eee710735a57a8cae6c0953ad1fe2cb6e17c2e5afebeb93b5ec
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                lwjgl_tinyfd.dll
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)\natives\lwjgl_tinyfd.dll
                                                                                • Size 243KB
                                                                                • SHA256 e4d0acfdace129aa3e255c0def6134d23565380692075b85ad85941ab8212c08
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Bliss_v2.1.2_(Chocapic13_Shaders_edit).zip
                                                                                • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\Real realistic world (realistic) (realistic world) Real realistic world (realistic) (realistic world)\shaderpacks\Bliss_v2.1.2_(Chocapic13_Shaders_edit).zip
                                                                                • Size 1.7MB
                                                                                • SHA256 27c2035644b886bdc1366190ce162c6bf6cac4ab6895891e687b5e6f0f3bbfaf
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                uninstall.xml
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                                                                • Size 4KB
                                                                                • SHA256 7b4a433c0e8e3552788bfcd77976b930efc8486f253006b06f38102fb1a08f28
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                uninstall.xml
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                                                                • Size 21KB
                                                                                • SHA256 ccd76c712930e8d5da6f74accb0f46910e27e0654a625c51787ae6b311e48fc9
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                version_manifest.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_launchermeta.mojang.com\mc\game\version_manifest.json
                                                                                • Size 204KB
                                                                                • SHA256 c25e8d6df9812c36ec41551ae9ac86e6dbb64ff8b4a87a5d2f36e8b390ffd1a5
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                5.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_piston-meta.mojang.com\v1\packages\3d1e8e9cad62f188270564f4bdfd3a79df9be65a\5.json
                                                                                • Size 403KB
                                                                                • SHA256 c84a3605953d709ea19764973c731cb52d8475401267207f54ff72573d005520
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                manifest.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_piston-meta.mojang.com\v1\packages\89ce85ccb518c62e18b4b58d63399ba2d9611426\manifest.json
                                                                                • Size 145KB
                                                                                • SHA256 f64702506a47c8706b1cd30e016a097945416ecd8bd6428d7ee622b23f121b3a
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                1.20.1.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_piston-meta.mojang.com\v1\packages\c0a00f47b3dae01d83e21be9a646c9232379d9ab\1.20.1.json
                                                                                • Size 34KB
                                                                                • SHA256 a7a179c602c505b0f1bafa1402130e7d1966a1674b13f547c466196860bae7f8
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                inner_servers-1.3.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\configs\inner_servers-1.3.json
                                                                                • Size 5KB
                                                                                • SHA256 3cd63fc16117d2a2c9906fd9dbcbb21e0569b6e6a1e20def0272f6316e87b920
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                index_en.html
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\configs_v1\pages\index_en.html
                                                                                • Size 52KB
                                                                                • SHA256 b89376f7c2213f92393a28a416cc25a5896a7e852b4d657e00e0e041c578e6f5
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                libraries-1.7.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\libraries\org\tlauncher\authlib\libraries-1.7.json
                                                                                • Size 377KB
                                                                                • SHA256 0a37d481b94fe7fb9fc60162c22038690c7d67eab09b0b2bfa3445dd01b23710
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                additional_assets-1.1.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\versions\new5\additional_assets-1.1.json
                                                                                • Size 190KB
                                                                                • SHA256 12ea0578ab812f6e6730ea5b23e7f8bfcbaec59e801b8699abc1e773a3b7476b
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                version_manifest.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\versions\new5\skin\versions\version_manifest.json
                                                                                • Size 12KB
                                                                                • SHA256 e5a04128c61d6c23b527b4914f3cacb711a6691d2eab89813f7f2f5a9d34069f
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                version_manifest.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\versions\new5\version_manifest.json
                                                                                • Size 49KB
                                                                                • SHA256 1537f055b6cd0faefdfe6376112bdb0236475b83906981fd6ac692cac36e5951
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                additional_hot_servers-1.0.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\lch\additional_hot_servers-1.0.json
                                                                                • Size 9KB
                                                                                • SHA256 ba3301eff47472937fcb878c83446061d10215b3d98ab095e87125defb0f597a
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                hot_servers-1.0.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\lch\servers\hot_servers-1.0.json
                                                                                • Size 18KB
                                                                                • SHA256 289d779623cef574393b226432a0a9f19a19586ffa330e7af65fbdc9bb0a74f6
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                java_configuration.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_rescl.tlauncher.org\b\jvm\java_configuration.json
                                                                                • Size 13KB
                                                                                • SHA256 b490908c9bda7f4ed5220145dee8dd1ee9ad92a210080adec3c183b0f0a50a8b
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                dependencies.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9378\dependencies.json
                                                                                • Size 25KB
                                                                                • SHA256 6ac4cc67b7d6c2740882d0969c77bd55f44d7e74047fb7e7723424ea799423cb
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                resources.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9378\resources.json
                                                                                • Size 17KB
                                                                                • SHA256 03b38fa542128e1c3ff9b057e19e6d1eb5cfefa5df0bcb4aa4dbd16d68162e48
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                appConfig.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\appConfig.json
                                                                                • Size 4KB
                                                                                • SHA256 3ff78a48297c9369947b007f8776f1762f4e0a7204b598c07f1d5b3437c3e021
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                javaConfig21.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\javaConfig21.json
                                                                                • Size 3KB
                                                                                • SHA256 4137156413e8ca1b38862aedd342bf6dbf6c2446fd4d86ea6893c0888f260893
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                COPYRIGHT
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\java.logging\COPYRIGHT
                                                                                • Size 35B
                                                                                • SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                LICENSE
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\java.logging\LICENSE
                                                                                • Size 33B
                                                                                • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                ADDITIONAL_LICENSE_INFO
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\javafx.web\ADDITIONAL_LICENSE_INFO
                                                                                • Size 51B
                                                                                • SHA256 0a256a7133bd2146482018ba6204a4ecc75836c139c8792da53536a9b67071d4
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ASSEMBLY_EXCEPTION
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\javafx.web\ASSEMBLY_EXCEPTION
                                                                                • Size 46B
                                                                                • SHA256 a4b7ad48df36316ddd7d47fcecc1d7a2c59cbfe22728930220ef63517fd58cb0
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                LICENSE
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\javafx.web\LICENSE
                                                                                • Size 35B
                                                                                • SHA256 01a4ebd2a3b2671d913582f1241a176a13e9be98f4e3d5f2f04813e122b88105
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                tlauncher-2.0.properties
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\tlauncher-2.0.properties
                                                                                • Size 1KB
                                                                                • SHA256 d1d5b1671c4e2fc253358654150d0292b0b4e0fa21645089562bbd56622015dc
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                tlauncher-2.0.properties
                                                                                • Path C:\Users\Admin\AppData\Roaming\.tlauncher\tlauncher-2.0.properties
                                                                                • Size 1KB
                                                                                • SHA256 811b67aad5a2854dd086b117c9c4288688a86eb7192e02453c6c2dffd967f0c1
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                settings.dat
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
                                                                                • Size 40B
                                                                                • SHA256 1afbbbe6de8048dfb03db4a9b210c7a053e332f21915247b13a25ddbe47dd330
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                67bf4ae1-20e5-49e4-ad80-39d6bde32818.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\67bf4ae1-20e5-49e4-ad80-39d6bde32818.tmp
                                                                                • Size 173B
                                                                                • SHA256 939a6db82dd17835131f997fe82365bc1249106301358cbf3393d7e37eb099ae
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                6f9a9974-fa38-4395-ab3f-a1d299ecfba7.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\6f9a9974-fa38-4395-ab3f-a1d299ecfba7.tmp
                                                                                • Size 357B
                                                                                • SHA256 6c3625406126292507b01335d155aa975a4f5514198dc08e45646fa41473c7bd
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                the-real-index
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
                                                                                • Size 48B
                                                                                • SHA256 bfe48756b3caa1f491df4436342c518ebdd4923d5f9cc2ff676c726be3bbc665
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                the-real-index
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
                                                                                • Size 384B
                                                                                • SHA256 5bf8ecb51a913943f5e64c074543deaaad926d632c56d7a1ce4bc478f180edba
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                000001.dbtmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extension Rules\000001.dbtmp
                                                                                • Size 16B
                                                                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                MANIFEST-000001
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extension Rules\MANIFEST-000001
                                                                                • Size 41B
                                                                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                Opera Custom Icon.ico1e138863-29aa-4403-b462-33b59c640fd2.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Opera Custom Icon.ico1e138863-29aa-4403-b462-33b59c640fd2.tmp
                                                                                • Size 162KB
                                                                                • SHA256 5903c920e584fc5f1e918bd641bf58fd56e8cb20bb68269892a4984ea7538621
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Preferences330a8679-9282-4bbe-a47c-aa6efad8b47f.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences330a8679-9282-4bbe-a47c-aa6efad8b47f.tmp
                                                                                • Size 14KB
                                                                                • SHA256 3ff7f1b6e30fa43dfe5365b994f1de42ca78aa9b6702e379aa2258e22aaa216a
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                f41d6f16-adeb-4949-98f3-39596b84f7df.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\f41d6f16-adeb-4949-98f3-39596b84f7df.tmp
                                                                                • Size 72B
                                                                                • SHA256 05635db4b9dff837444356b6db3fffd1afaaa8e4af254e75e1847b4f8cab7fbf
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                the-real-index
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                • Size 120B
                                                                                • SHA256 3a34fe7d53f0f3f2a20ce49d7bb37abdab222a1db089851cc08d984f583db34f
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                825dc32f-7cd9-40cd-8f6d-b07ad1149dca.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\825dc32f-7cd9-40cd-8f6d-b07ad1149dca.tmp
                                                                                • Size 381B
                                                                                • SHA256 8f6427dc0e248cb96e137505498d2a21c8232280049ae069b4c24190ee0449ba
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 493B
                                                                                • SHA256 4f3d79836c751ed449883f33653efabd3d0dc4e981a77afb6f5a6e724324f8db
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 605B
                                                                                • SHA256 a66389577e13a69e41120c78c379b6c949f8bba3f97589ff554403e358e04295
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 1KB
                                                                                • SHA256 38ca3a3433a454cf721ebd592e3ad3dfc0c1e0be9dd6e36f0be3ffb6106094f7
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 1KB
                                                                                • SHA256 36f79e6473835019275b0440fde7f44615259de3e3e70ede262d059e15a09f52
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 1KB
                                                                                • SHA256 b45f00d0c1f837de97192a1b47b59e2e6581cad087bb88c38b09251277ba0aac
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 1KB
                                                                                • SHA256 21453c4e01f2538a91f22627ba15e7b325c1631a42080880f211a97fb04f84a7
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 2KB
                                                                                • SHA256 82abb9d1f02787b74155b05a012436749b7c6313928be32f770fe8572ac1c6ee
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 733B
                                                                                • SHA256 a898e707e21250f8cd785a122d615677af55f9bbdd046cd5cecb6ebc5aadc057
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 1KB
                                                                                • SHA256 69c630914e98ac95a965c03bda0df876260e3c412952a782abe6ddc6214c263d
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 1KB
                                                                                • SHA256 d81f8cc030aacd0d79d5e73e667fede273fab631ed405b7d982f6ea551144d5e
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 1KB
                                                                                • SHA256 fb701dc19dfe59d218164c13fc57772fbdfe4d25f42bca5d456347ad0c9d2f9b
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 1KB
                                                                                • SHA256 4aa700d2144f8d2f2f72a26058209db913e960655bb671e27f3470ea4e406ad8
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 2KB
                                                                                • SHA256 fff18176636501fb45c272a0eedcf32e96472b5f8973f5ee13e9e8da82678388
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 2KB
                                                                                • SHA256 e996011e4effbc00282e0bf9cdc55f7484a0f2232f97ec3b4bd79c72c8362bdc
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 7KB
                                                                                • SHA256 e4e1c9507f6c63c8d0ae4129dc4c25ed3703e06fcad168d491240960d2c169b8
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 8KB
                                                                                • SHA256 085ddb6589b9bb0cc1ee634e3b596c7a8709ea893c7b39f4f751e65da6c7aa89
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 8KB
                                                                                • SHA256 6f77b19369c5fa717a3fa72aeca3c955b01bdea36293c3ce5cac2aa6b3359b4e
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 8KB
                                                                                • SHA256 05b7c5fca95e057607e5f9e5bccd9704fcb09e5be7f7ad0f1c439b350d3dfdc0
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 8KB
                                                                                • SHA256 46460bcf95f80032b7bdb6bd584ece1578065f9d9ee8e3068f2ada7bb3b0bece
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 8KB
                                                                                • SHA256 44d4acd8cfebda2727638c479ca8573deadea63a81412d6a6413e038db2850ee
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 8KB
                                                                                • SHA256 7820516ad6c2873a6e7c55930012780d063674fd28f19f44bf407ac747e57cc5
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 909B
                                                                                • SHA256 03837098e0bc3295d279bad6af56f70fb87877da45e9728a13c2431f5245d26a
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 2KB
                                                                                • SHA256 2d78f37c93c51122f231683a926433b70f23cf16d43ba65af055a3eb294f190d
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 2KB
                                                                                • SHA256 9cc0b44514fd486fdc8c52b2193f6b2351ef4704a231a64f0e9c09cb7b26edd6
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 2KB
                                                                                • SHA256 99bf58c86c59fe665c7bc785686371a4c7df38b288b8c84dd41e2f7240c65d01
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 1KB
                                                                                • SHA256 4ae46cfa329d2e89ec5219f20fbb695d79f7ceb2dd4f13e8a7ccae7fa4b5e97a
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 8KB
                                                                                • SHA256 7f32f53ce15384f314f2f29d1b7ecd00eae2293230a76a7cd653190321cf4515
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 8KB
                                                                                • SHA256 4888c50f4454b0957d3d5efc2b9c125c8fbec3202209f6f3697d4ede81b1f134
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 2KB
                                                                                • SHA256 ea8e8a2b2fce4461a448c12ac896898744f3fddc9b01d2ba541a271200f939c1
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 8KB
                                                                                • SHA256 5f343d59998107f5908324ea6b327dcf8f42b15160062f78719410af2b0ef548
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 8KB
                                                                                • SHA256 5e3d29920330db735225a416c0ca93e1e93307c8a2fe6b574fb4e7a478bce611
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 8KB
                                                                                • SHA256 5d1bc1b7b3e0480845d3c5371f4c399c0764bb33d298ff3f91cbdb9f2cf0809e
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 8KB
                                                                                • SHA256 c9a5cfe097bf4084068fd311ad6c347bc8fc431ef85de5421b356075ec07d337
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_fc772632-fcda-42c6-ac5d-c266dbb87071.raw
                                                                                • Size 2KB
                                                                                • SHA256 d18f2ba746f1cc60f37f4fee883b814968771a39e857f0d41b44ecc836da8fd7
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                afa0c8a3-2fd2-4b19-8939-37f2b89b3d6d.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\afa0c8a3-2fd2-4b19-8939-37f2b89b3d6d.tmp
                                                                                • Size 171B
                                                                                • SHA256 a54f8c645e0905644a300129f56b100493efb90c17fe2078bdcf8d2e168fb1df
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.0.316457517
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.0.316457517
                                                                                • Size 1KB
                                                                                • SHA256 e643a396f61216439e1677f7d8c577bf8ecd11259fb26cb9682a15bc0e3fe53a
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.0.316457517
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.0.316457517
                                                                                • Size 1KB
                                                                                • SHA256 1f4fe8238ceb97468307610b457dde455fbed0170d0da2dbce0623e8788049af
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.0.316457517
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.0.316457517
                                                                                • Size 2KB
                                                                                • SHA256 0322d91e17ac91f90cb8fd55c3593f7ce627bf5eaa71e2f3aea3c307c8b17269
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.0.316457517
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.0.316457517
                                                                                • Size 2KB
                                                                                • SHA256 351b7e6af8e81440e93a180a91cd126510ac74b78ff2869c1e2c0fa4e208c90c
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.0.316457517
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.0.316457517
                                                                                • Size 577B
                                                                                • SHA256 7b28b24ffa87b0ce7d27604e6c7d1461eb5de122170522889468116ec3108481
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.0.316457517
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.0.316457517
                                                                                • Size 2KB
                                                                                • SHA256 6a3c49fe4fba6101e98b2226f20abaff5be47c3217cbeb220fdc2eaa64c8adc9
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.0.316457517
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.0.316457517
                                                                                • Size 515B
                                                                                • SHA256 368eba527de38c77a2e57f92e976f58473e33931e17ec8b1bad20a4e1c7cb319
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.0.316457517
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.0.316457517
                                                                                • Size 417B
                                                                                • SHA256 622e0542dfe9fc0c9484a5cc63b10d1e6cd5706febb9e60869f61a86f7be7c1f
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.0.316457517
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.0.316457517
                                                                                • Size 2KB
                                                                                • SHA256 284135638c30e3222da71331bc49442e449d12285b7cdd67e0f5b9c10ba4d7df
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.0.316457517
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.0.316457517
                                                                                • Size 2KB
                                                                                • SHA256 8678d731bb6517beac83bf6bf9213757a224d826830d9bf881839733302f23de
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.0.316457517
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.0.316457517
                                                                                • Size 2KB
                                                                                • SHA256 0e804d621c4d02aebe2450341d6f28e5a08c217a5f7debfedafe58a3a6ce65a2
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.0.316457517
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.0.316457517
                                                                                • Size 2KB
                                                                                • SHA256 77f96858153b3ce34164e1eeebd35fdc38ffbd297caeb48ab02b56da270b154c
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.1.799175786
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.1.799175786
                                                                                • Size 231B
                                                                                • SHA256 0f83d85626a6e1be53dbc772eb8fd5fa8ee61326bacf07f139263219f810c14c
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.1.799175786
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.1.799175786
                                                                                • Size 1KB
                                                                                • SHA256 5e9dffa96d069b5a6460c5a97fcf1a89c91af61ec356b2d7143ec73603f5cf7a
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.1.799175786
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.1.799175786
                                                                                • Size 1KB
                                                                                • SHA256 e3d3a3c9af78c5724fabf142a1ef197859d8272df775c84cbf84d871878580e6
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.1.799175786
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.1.799175786
                                                                                • Size 329B
                                                                                • SHA256 8662b044df0dbaf72302c4f27c7e1ae94177278d0ee4bf2b6f9f8fc557c9b1ab
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.1.799175786
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.1.799175786
                                                                                • Size 2KB
                                                                                • SHA256 b83ff4507813edbfb399126e8749500a457aa53e582cf92d3353cb97db4bd1d3
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.1.799175786
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.1.799175786
                                                                                • Size 2KB
                                                                                • SHA256 caba091ef2afadd1fd610197da5cfb3fe4e2cd056ba590c0b1ed862133242075
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.1.799175786
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.1.799175786
                                                                                • Size 2KB
                                                                                • SHA256 d1142642fc5c2ff44b8825264ee89eabb7781689e134b692c99e3df241e815b3
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.1.799175786
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.1.799175786
                                                                                • Size 2KB
                                                                                • SHA256 5be9268cb3ac5eac8f2d4d7fc4e05b69f7c7574e32c90944568aafed34d80682
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.1.799175786
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.1.799175786
                                                                                • Size 2KB
                                                                                • SHA256 23368cb84f5688e2fdc1b57abb7d6fc42089a0d39c56768be176d93127c2540c
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.1.799175786
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.1.799175786
                                                                                • Size 391B
                                                                                • SHA256 241639daa7aac9a3d6bacaed65e57adbb831e7bfffbc9d30e2b042dc88d50e3e
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.1.799175786
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.1.799175786
                                                                                • Size 2KB
                                                                                • SHA256 560eed3dc852125c3495fed3456c7826c9d39604de08ecfcf7b69b8f7dc36a74
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.1.799175786
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.1.799175786
                                                                                • Size 2KB
                                                                                • SHA256 76700b93f9422a9a1fa86143bf70b2d81207eb862555dd2ae536e2c1dd7dde10
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.2.738270022
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.2.738270022
                                                                                • Size 217B
                                                                                • SHA256 a6b7dcf0ce89d72d293d87342c9b456094c0d87844917fa0861c0531ba9a1e72
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp3504.2.738270022
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp3504.2.738270022
                                                                                • Size 173B
                                                                                • SHA256 94399020f78d0f55117160277986a17c3f5aeb0dfb2dfb3695a9a37607da36a0
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                data_0
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_0
                                                                                • Size 8KB
                                                                                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                Submit Download

                                                                                data_1
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_1
                                                                                • Size 264KB
                                                                                • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                Submit Download

                                                                                data_2
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_2
                                                                                • Size 8KB
                                                                                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                Submit Download

                                                                                data_3
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_3
                                                                                • Size 8KB
                                                                                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                Submit Download

                                                                                VariationsSeedV2
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\VariationsSeedV2
                                                                                • Size 11B
                                                                                • SHA256 b4cc4174735c28360b9081be3c3d0552d8a4b3cdb54431ac00ed0d622bab6296
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                VariationsSeedV2
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\VariationsSeedV2
                                                                                • Size 19B
                                                                                • SHA256 1560b22b2264f7cb6b7f6910164813f76c5e8a06fb1acf85b375e687ee49c1ad
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                assistant_prefs.json
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\assistant_prefs.json
                                                                                • Size 150B
                                                                                • SHA256 b43d4c56e794613888e6864e4efd7c4fb746a814f66d56bebdd3318a3ea294ba
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ffbaf9bf-49ff-41d1-a432-3b5b117b85bd.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\ffbaf9bf-49ff-41d1-a432-3b5b117b85bd.tmp
                                                                                • Size 150B
                                                                                • SHA256 c949a9b263110d5c55e78bd5cbc76bb6e712c0964224c026c4ce7dc28a0c6889
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                desktop.ini
                                                                                • Path C:\Users\Admin\Videos\Captures\desktop.ini
                                                                                • Size 190B
                                                                                • SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                logo.png
                                                                                • Path C:\Windows\Temp\{1AB27FCD-FED9-4FA0-9134-A7423BB5CE7D}\.ba\logo.png
                                                                                • Size 1KB
                                                                                • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                wixstdba.dll
                                                                                • Path C:\Windows\Temp\{1AB27FCD-FED9-4FA0-9134-A7423BB5CE7D}\.ba\wixstdba.dll
                                                                                • Size 215KB
                                                                                • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                                                                • Path C:\Windows\Temp\{1AB27FCD-FED9-4FA0-9134-A7423BB5CE7D}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                                                                • Size 5.4MB
                                                                                • SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                cab5046A8AB272BF37297BB7928664C9503
                                                                                • Path C:\Windows\Temp\{1AB27FCD-FED9-4FA0-9134-A7423BB5CE7D}\cab5046A8AB272BF37297BB7928664C9503
                                                                                • Size 964KB
                                                                                • SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                vcRuntimeAdditional_x64
                                                                                • Path C:\Windows\Temp\{1AB27FCD-FED9-4FA0-9134-A7423BB5CE7D}\vcRuntimeAdditional_x64
                                                                                • Size 208KB
                                                                                • SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                vcRuntimeMinimum_x64
                                                                                • Path C:\Windows\Temp\{1AB27FCD-FED9-4FA0-9134-A7423BB5CE7D}\vcRuntimeMinimum_x64
                                                                                • Size 208KB
                                                                                • SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                license.rtf
                                                                                • Path C:\Windows\Temp\{22F9FD63-650D-4ACF-80C9-6EC128152A6E}\.ba\license.rtf
                                                                                • Size 9KB
                                                                                • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                thm.wxl
                                                                                • Path C:\Windows\Temp\{22F9FD63-650D-4ACF-80C9-6EC128152A6E}\.ba\thm.wxl
                                                                                • Size 2KB
                                                                                • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                thm.xml
                                                                                • Path C:\Windows\Temp\{22F9FD63-650D-4ACF-80C9-6EC128152A6E}\.ba\thm.xml
                                                                                • Size 8KB
                                                                                • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                wixstdba.dll
                                                                                • Path C:\Windows\Temp\{22F9FD63-650D-4ACF-80C9-6EC128152A6E}\.ba\wixstdba.dll
                                                                                • Size 191KB
                                                                                • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                vc_redist.x64.exe
                                                                                • Path C:\Windows\Temp\{3647FA01-5388-4ED4-A916-9DA00B5593C6}\.cr\vc_redist.x64.exe
                                                                                • Size 670KB
                                                                                • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                memory/1100-570-0x0000000000860000-0x0000000000E61000-memory.dmp
                                                                                Download

                                                                                memory/1100-652-0x0000000000860000-0x0000000000E61000-memory.dmp
                                                                                Download

                                                                                memory/1100-2927-0x0000000000860000-0x0000000000E61000-memory.dmp
                                                                                Download

                                                                                memory/1100-569-0x0000000000860000-0x0000000000E61000-memory.dmp
                                                                                Download

                                                                                memory/1100-751-0x0000000000860000-0x0000000000E61000-memory.dmp
                                                                                Download

                                                                                memory/1100-921-0x0000000000860000-0x0000000000E61000-memory.dmp
                                                                                Download

                                                                                memory/1100-17-0x0000000000860000-0x0000000000E61000-memory.dmp
                                                                                Download

                                                                                memory/1100-1220-0x0000000000860000-0x0000000000E61000-memory.dmp
                                                                                Download

                                                                                memory/1100-2052-0x0000000000860000-0x0000000000E61000-memory.dmp
                                                                                Download

                                                                                memory/1224-4501-0x000002176E0A0000-0x000002176E0A1000-memory.dmp
                                                                                Download

                                                                                memory/1224-4504-0x000002176E0A0000-0x000002176E0A1000-memory.dmp
                                                                                Download

                                                                                memory/1224-4499-0x000002176E0A0000-0x000002176E0A1000-memory.dmp
                                                                                Download

                                                                                memory/1224-4500-0x000002176E0A0000-0x000002176E0A1000-memory.dmp
                                                                                Download

                                                                                memory/1224-4493-0x000002176E0A0000-0x000002176E0A1000-memory.dmp
                                                                                Download

                                                                                memory/1224-4495-0x000002176E0A0000-0x000002176E0A1000-memory.dmp
                                                                                Download

                                                                                memory/1224-4494-0x000002176E0A0000-0x000002176E0A1000-memory.dmp
                                                                                Download

                                                                                memory/1224-4505-0x000002176E0A0000-0x000002176E0A1000-memory.dmp
                                                                                Download

                                                                                memory/1224-4502-0x000002176E0A0000-0x000002176E0A1000-memory.dmp
                                                                                Download

                                                                                memory/1224-4503-0x000002176E0A0000-0x000002176E0A1000-memory.dmp
                                                                                Download

                                                                                memory/2688-1007-0x0000000000DB0000-0x0000000000E27000-memory.dmp
                                                                                Download

                                                                                memory/2828-1955-0x0000000000760000-0x0000000000D61000-memory.dmp
                                                                                Download

                                                                                memory/2828-728-0x0000000000760000-0x0000000000D61000-memory.dmp
                                                                                Download

                                                                                memory/2828-624-0x0000000000760000-0x0000000000D61000-memory.dmp
                                                                                Download

                                                                                memory/2828-2829-0x0000000000760000-0x0000000000D61000-memory.dmp
                                                                                Download

                                                                                memory/2828-854-0x0000000000760000-0x0000000000D61000-memory.dmp
                                                                                Download

                                                                                memory/2828-1210-0x0000000000760000-0x0000000000D61000-memory.dmp
                                                                                Download

                                                                                memory/3660-1009-0x0000000000DB0000-0x0000000000E27000-memory.dmp
                                                                                Download

                                                                                memory/4528-1010-0x0000000000DB0000-0x0000000000E27000-memory.dmp
                                                                                Download

                                                                                memory/4996-4539-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4585-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4577-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4576-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4573-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4571-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4565-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4566-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4558-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4618-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4543-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4579-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4616-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4613-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4546-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4580-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4547-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4582-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4583-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4578-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4544-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4545-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4537-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4538-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4533-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4586-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4567-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4591-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4590-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4588-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4592-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4599-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4594-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4601-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4614-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/4996-4615-0x00000210595B0000-0x000002105A5B0000-memory.dmp
                                                                                Download

                                                                                memory/5584-2910-0x0000029BED410000-0x0000029BEECAA000-memory.dmp
                                                                                Download

                                                                                memory/5668-1863-0x00007FFDDA020000-0x00007FFDDA021000-memory.dmp
                                                                                Download

                                                                                memory/5668-1864-0x00007FFDD9DB0000-0x00007FFDD9DB1000-memory.dmp
                                                                                Download

                                                                                memory/7028-2943-0x00007FF6E2030000-0x00007FF6E64FD000-memory.dmp
                                                                                Download