Overview

overview

7

Static

static

1

TLauncher-....6.exe

windows10-ltsc_2021-x64

7

TLauncher-....6.exe

windows11-21h2-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    574s
  • max time network
    560s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    01/10/2026, 11:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TLauncher-Installer-1.9.7.6.exe
  • Size 59.1MB
  • Sample261001-nqtkrazfnc
  • SHA256 198cb8b4ac93307269d38ee15ef481dcf6b77b57c3a3aa7a6cbebc6195aa1751
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Writes a Windows system DLL name to a user directory 2 TTPs 2 IoCs

    A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

    defense_evasion
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 30 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Windows directory 23 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 30 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 11 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 13 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.7.6.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.7.6.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3938314 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.7.6.exe" "__IRCT:3" "__IRTSS:61981678" "__IRSID:S-1-5-21-3562044790-535044693-348086427-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Users\Admin\AppData\Local\Temp\TL-INSTALLER.exe
        "C:\Users\Admin\AppData\Local\Temp\TL-INSTALLER.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:416
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:3844106 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TL-INSTALLER.exe" "__IRCT:3" "__IRTSS:3967680" "__IRSID:S-1-5-21-3562044790-535044693-348086427-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2516
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3632
            • C:\Users\Admin\AppData\Local\Temp\7zS03E89A69\installer.exe
              C:\Users\Admin\AppData\Local\Temp\7zS03E89A69\installer.exe --silent --allusers=0 --server-tracking-blob=MzI5M2E5NmVjYzA1NTE5OTEwODM5MjFmOWY0ZGJiMmU4MjkwMzY1MmI3MjI1NDk4ZjkxNWRlNGJmNzU1ZDc3Zjp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInRpbWVzdGFtcCI6IjE3OTA4NTQ2NzkuMjQzNyIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgMTAuMCIsInV0bSI6eyJjYW1wYWlnbiI6Ik9wZXJhR1giLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6Ik1TVEwifSwidXVpZCI6IjQ1ZTkzNzA3LTlmMzgtNDdlYi05NTM2LTE3MTQyMzA5Y2YxNyJ9
              6⤵
              • Enumerates connected drives
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • Enumerates system info in registry
              • Modifies system certificate store
              • Suspicious use of WriteProcessMemory
              PID:3068
              • C:\Users\Admin\AppData\Local\Temp\7zS03E89A69\installer.exe
                C:\Users\Admin\AppData\Local\Temp\7zS03E89A69\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff6bee77998,0x7ff6bee779a8,0x7ff6bee779b8
                7⤵
                • Executes dropped EXE
                PID:3240
              • C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\installer.exe" --version
                7⤵
                • Executes dropped EXE
                PID:4320
              • C:\Users\Admin\AppData\Local\Temp\7zS03E89A69\installer.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS03E89A69\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3068 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_20261001123758" --session-guid=59a1d584-2af3-47ae-a053-4015ad1ce231 --server-tracking-blob="YmVhNGI3ZTRmNDQ1MWJhMDg3YWIxNjg4MDlkMzE4YzBkNzNmNTJiYTNiNzBkOThjODkwNmJkYjRkMTYxZDZhOTp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc5MDg1NDY3OS4yNDM3IiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSAxMC4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFHWCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiNDVlOTM3MDctOWYzOC00N2ViLTk1MzYtMTcxNDIzMDljZjE3In0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=6808000000000000
                7⤵
                • Enumerates connected drives
                • Executes dropped EXE
                • Enumerates system info in registry
                • Suspicious use of WriteProcessMemory
                PID:3880
                • C:\Users\Admin\AppData\Local\Temp\7zS03E89A69\installer.exe
                  C:\Users\Admin\AppData\Local\Temp\7zS03E89A69\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x28c,0x290,0x294,0x25c,0x298,0x7ff6bee77998,0x7ff6bee779a8,0x7ff6bee779b8
                  8⤵
                  • Executes dropped EXE
                  PID:1004
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe" --backend --initial-pid=3068 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581" --session-guid=59a1d584-2af3-47ae-a053-4015ad1ce231 --server-tracking-blob="YmVhNGI3ZTRmNDQ1MWJhMDg3YWIxNjg4MDlkMzE4YzBkNzNmNTJiYTNiNzBkOThjODkwNmJkYjRkMTYxZDZhOTp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc5MDg1NDY3OS4yNDM3IiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSAxMC4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFHWCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiNDVlOTM3MDctOWYzOC00N2ViLTk1MzYtMTcxNDIzMDljZjE3In0= " --silent --desktopshortcut=1 --install-subfolder=136.0.6008.76
                  8⤵
                  • Enumerates connected drives
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  • Modifies registry class
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:1628
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x290,0x294,0x298,0x268,0x29c,0x7ff7e44c7998,0x7ff7e44c79a8,0x7ff7e44c79b8
                    9⤵
                    • Executes dropped EXE
                    PID:1832
                  • C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581\assistant\assistant_installer.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --copyonly=0 --allusers=0
                    9⤵
                    • Writes a Windows system DLL name to a user directory
                    • Adds Run key to start application
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Enumerates system info in registry
                    • Modifies Internet Explorer settings
                    • Suspicious use of WriteProcessMemory
                    PID:3836
                    • C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581\assistant\assistant_installer.exe
                      "C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x8dc9cc,0x8dc9d8,0x8dc9e4
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:2728
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --run-assistant --allusers=0
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:2616
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x69c9cc,0x69c9d8,0x69c9e4
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        PID:4816
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe"
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Reads the TCP/IP host and domain name from the registry
                        • System Location Discovery: System Language Discovery
                        • Enumerates system info in registry
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:772
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Enumerates system info in registry
                          • Suspicious use of WriteProcessMemory
                          PID:4844
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x12c,0x130,0x134,0x128,0x138,0x7ffe9435ec30,0x7ffe9435ec40,0x7ffe9435ec50
                            13⤵
                            • Executes dropped EXE
                            PID:2796
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Enumerates system info in registry
                          • Suspicious use of WriteProcessMemory
                          PID:3568
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x12c,0x130,0x134,0x128,0x138,0x7ffe9435ec30,0x7ffe9435ec40,0x7ffe9435ec50
                            13⤵
                            • Executes dropped EXE
                            PID:2260
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x298,0x29c,0x2a0,0x258,0x2a4,0x10a7324,0x10a7330,0x10a733c
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:4848
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Enumerates system info in registry
                            • Suspicious use of WriteProcessMemory
                            PID:3292
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x130,0x134,0x138,0x12c,0x13c,0x7ffe9435ec30,0x7ffe9435ec40,0x7ffe9435ec50
                              14⤵
                              • Executes dropped EXE
                              PID:2604
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Enumerates system info in registry
                            • Suspicious use of WriteProcessMemory
                            PID:4728
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x12c,0x130,0x134,0x128,0x138,0x7ffe9435ec30,0x7ffe9435ec40,0x7ffe9435ec50
                              14⤵
                              • Executes dropped EXE
                              PID:900
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of WriteProcessMemory
                            PID:3612
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x10c,0x130,0x134,0x108,0x138,0x7ffe9435ec30,0x7ffe9435ec40,0x7ffe9435ec50
                              14⤵
                              • Executes dropped EXE
                              PID:4940
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
                    9⤵
                    • Adds Run key to start application
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Reads the TCP/IP host and domain name from the registry
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of WriteProcessMemory
                    PID:1604
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x12c,0x130,0x134,0x128,0x138,0x7ffe9435ec30,0x7ffe9435ec40,0x7ffe9435ec50
                      10⤵
                      • Executes dropped EXE
                      PID:3744
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1592,i,2509151984660756077,14366203576358547137,262144 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1852 /prefetch:2
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5168
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=1956,i,17956463248198133649,18332507853487960340,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1992 /prefetch:11
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Reads the TCP/IP host and domain name from the registry
                      • System Time Discovery
                      • Enumerates system info in registry
                      PID:5192
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=2432,i,13927851343473204716,17841908226359112431,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2500 /prefetch:13
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5340
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3364,i,7409544988873039713,16809057332243683605,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3384 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:5508
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3204,i,12776031425522233687,16175205799325913111,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3404 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:5516
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3176,i,6819388137225649968,2725753176758736597,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3212 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5528
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3164,i,14805311281760177325,8813017620267911777,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3456 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5540
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3152,i,17409088182860968978,9331246743130430169,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3472 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:5548
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=2988,i,12559359875453565336,12487434088271202252,2097152 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3532 /prefetch:1
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5556
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3188,i,10691350140431027191,130172971052524041,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3424 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5564
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_gx_splash.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_gx_splash.exe" --instance-name=61C8973803226C4D4008DEBC18682105EDAB1556896BB924D0EEB1B6C96AB147
                      10⤵
                      • Executes dropped EXE
                      PID:5224
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4660,i,7788252181929082071,12496706860482644600,2097152 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4676 /prefetch:1
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5872
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4892,i,15584947295919138001,15589512107270506455,2097152 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4920 /prefetch:9
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:484
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5064,i,6543761730808281362,7883055468438571618,2097152 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5080 /prefetch:1
                      10⤵
                      • Executes dropped EXE
                      PID:5892
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5284,i,14955656246538389337,6168527985014721376,2097152 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5296 /prefetch:1
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:5920
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --asus-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5416,i,11908453429300610222,15294485392306585637,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5412 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:5932
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --corsair-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5424,i,9948844168064919734,17631906569816581737,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5420 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      PID:5940
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --logitech-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5428,i,1470984325501194774,110784463446633779,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5440 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:5952
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --razer-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5432,i,6969373734730889919,1037938545650799674,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5452 /prefetch:14
                      10⤵
                      • Executes dropped EXE
                      PID:5916
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6004,i,1492197561217008127,7077607413882620889,2097152 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6020 /prefetch:9
                      10⤵
                      • Executes dropped EXE
                      PID:6020
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6680,i,17122853788303217089,5531808318959658993,2097152 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6676 /prefetch:1
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6216
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=6876,i,14094481424970053273,13774762886481642539,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6888 /prefetch:12
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6340
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6864,i,15799540699945884930,6056119087854946104,2097152 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6968 /prefetch:9
                      10⤵
                      • Executes dropped EXE
                      PID:6584
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7256,i,693216709615226408,13251121655192674399,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7348 /prefetch:14
                      10⤵
                      • Enumerates system info in registry
                      PID:7072
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7268,i,394002097693783866,16885606522472465281,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7368 /prefetch:14
                      10⤵
                        PID:7080
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7304,i,12338158112623798993,15105417995833469791,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7324 /prefetch:14
                        10⤵
                        • Enumerates system info in registry
                        PID:7064
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7336,i,9149943096225855782,17169735540109520766,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7752 /prefetch:14
                        10⤵
                        • Enumerates system info in registry
                        PID:7104
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7512,i,16196690851627579124,2953756548132283006,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7284 /prefetch:14
                        10⤵
                          PID:7112
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8052,i,10725664251486621892,15997852603063034537,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=8068 /prefetch:14
                          10⤵
                            PID:6472
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8204,i,15374025347409231156,11469094991065996807,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8212 /prefetch:14
                            10⤵
                              PID:6484
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8220,i,7576646144255655392,7620885941287033091,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8252 /prefetch:14
                              10⤵
                              • Enumerates system info in registry
                              PID:6512
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8240,i,11445987689998032378,1608778637814657389,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8272 /prefetch:14
                              10⤵
                              • Enumerates system info in registry
                              PID:6556
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8408,i,17884348239483273469,14452283538249789690,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8648 /prefetch:14
                              10⤵
                              • Enumerates system info in registry
                              PID:6576
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8792,i,1173093871231630711,5396608731402323351,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8812 /prefetch:14
                              10⤵
                              • Enumerates system info in registry
                              PID:5220
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=9420,i,14188829675976801502,14193278539275851376,2097152 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=9476 /prefetch:9
                              10⤵
                                PID:6788
                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=9452,i,10126937395196237841,3680233656833819587,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9588 /prefetch:14
                                10⤵
                                • Enumerates system info in registry
                                PID:6968
                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=9388,i,5530673897796352130,7129961111545452992,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9780 /prefetch:14
                                10⤵
                                  PID:6808
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=9928,i,5938407369851592534,17896422713319853686,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=9940 /prefetch:14
                                  10⤵
                                    PID:6772
                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=10088,i,2635334317008695859,15348472600505352166,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=9404 /prefetch:14
                                    10⤵
                                      PID:7076
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=10212,i,10888130332700181546,15299043008771534022,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=3440 /prefetch:14
                                      10⤵
                                      • Enumerates system info in registry
                                      PID:6736
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=10476,i,5763456153468565344,15326955773503210339,2097152 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10412 /prefetch:1
                                      10⤵
                                        PID:6792
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --pipeid=oauc_pipeF347B60CA73F3F3DA84B31019F4EB851ECFC332513021FC062CC0CA8D8440B54
                                        10⤵
                                        • Reads the TCP/IP host and domain name from the registry
                                        • Enumerates system info in registry
                                        PID:7752
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff776366598,0x7ff7763665a8,0x7ff7763665b8
                                          11⤵
                                            PID:8468
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.side_profiles.mojom.SideProfilesHandler --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3416,i,4581973999333154105,394624006207211848,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=3868 /prefetch:14
                                          10⤵
                                          • Enumerates system info in registry
                                          PID:8768
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3168,i,17420268515043086196,7452708719252431582,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=4196 /prefetch:14
                                          10⤵
                                          • Enumerates system info in registry
                                          PID:8960
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3912,i,2935942216427854972,463646536011034103,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=10688 /prefetch:14
                                          10⤵
                                          • Enumerates system info in registry
                                          PID:8996
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3468,i,17233343111313983398,12622366687737835152,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=7632 /prefetch:14
                                          10⤵
                                          • Enumerates system info in registry
                                          PID:7432
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3472,i,10844553517584603523,4103305929303139520,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=5792 /prefetch:14
                                          10⤵
                                          • Enumerates system info in registry
                                          PID:7564
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=10800,i,17403971306743847968,9702257302848994487,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=9428 /prefetch:14
                                          10⤵
                                          • Enumerates system info in registry
                                          PID:7604
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8604,i,14977246761994120434,9882627546274883414,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=5988 /prefetch:14
                                          10⤵
                                          • Enumerates system info in registry
                                          PID:7724
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=6060,i,13197025125661332305,11870415339835297757,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=5868 /prefetch:14
                                          10⤵
                                          • Enumerates system info in registry
                                          PID:7872
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=10048,i,12392840394596152931,6824368979877164105,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=9928 /prefetch:14
                                          10⤵
                                          • Enumerates system info in registry
                                          PID:8012
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8924,i,6595260078386950420,10704683074949679120,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=4596 /prefetch:14
                                          10⤵
                                          • Enumerates system info in registry
                                          PID:8816
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5856,i,2451039892375771498,764717699250479930,524288 --field-trial-handle=1856,i,599894110135205210,2419202627371862112,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1860,i,3958294252308425729,12561566069652409178,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=10404 /prefetch:14
                                          10⤵
                                          • Enumerates system info in registry
                                          PID:6796
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --edition=std-2 --host=https://autoupdate.opera.com/ --installationdatadir="C:\Users\Admin\AppData\Local\Programs\Opera GX" --installdir="C:\Users\Admin\AppData\Local\Programs\Opera GX" --lang=en-US --pipeid --producttype --requesttype=shutdown --version=136.0.6008.76 --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --firstrunver=136.0.6008.76 --firstrunts=1790854729 --consent-info=eyJzdGF0aXN0aWNzX2NvbGxlY3Rpb25fZW5hYmxlZCI6dHJ1ZSwidXNlcl9leHBlcmllbmNlX21ldHJpY3NfcmVwb3J0aW5nX2VuYWJsZWQiOnRydWV9
                                          10⤵
                                          • Reads the TCP/IP host and domain name from the registry
                                          • Enumerates system info in registry
                                          PID:6724
                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff776366598,0x7ff7763665a8,0x7ff7763665b8
                                            11⤵
                                              PID:9072
                                    • C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581\assistant\Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe
                                      "C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581\assistant\Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe"
                                      7⤵
                                      • Writes a Windows system DLL name to a user directory
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:1968
                                    • C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581\assistant\assistant_installer.exe
                                      "C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581\assistant\assistant_installer.exe" --version
                                      7⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:3420
                                      • C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581\assistant\assistant_installer.exe
                                        "C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x8dc9cc,0x8dc9d8,0x8dc9e4
                                        8⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        PID:4296
                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\vc2015_22\vc_redist.x64.exe
                              "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\vc2015_22\vc_redist.x64.exe" /passive /norestart
                              3⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:1612
                              • C:\Windows\Temp\{4EAA049E-44C3-4B3B-B8E0-7834E8489B22}\.cr\vc_redist.x64.exe
                                "C:\Windows\Temp\{4EAA049E-44C3-4B3B-B8E0-7834E8489B22}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\vc2015_22\vc_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=756 /passive /norestart
                                4⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of WriteProcessMemory
                                PID:4032
                                • C:\Windows\Temp\{0176D611-EA3B-4C23-9619-B7A4315CF0F9}\.be\VC_redist.x64.exe
                                  "C:\Windows\Temp\{0176D611-EA3B-4C23-9619-B7A4315CF0F9}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{383C6046-632F-47B5-A4EE-D6DE6FAF65CD} {B9D72795-8AF5-4F0A-A560-4A25FEDAF668} 4032
                                  5⤵
                                  • Adds Run key to start application
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:480
                                  • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1096 -burn.embedded BurnPipe.{56BE33D6-C2BF-46E5-9685-4EAB623B2270} {92A58114-1FF3-4BD4-904C-BE7855D541AC} 480
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:4800
                                    • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=604 -burn.filehandle.self=620 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1096 -burn.embedded BurnPipe.{56BE33D6-C2BF-46E5-9685-4EAB623B2270} {92A58114-1FF3-4BD4-904C-BE7855D541AC} 480
                                      7⤵
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:464
                                      • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{AF1F45BE-F689-4C9F-8F7F-56BCC044E598} {EA46D1F2-29CE-4C9C-BBD2-4BA7752F50CB} 464
                                        8⤵
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        PID:3436
                            • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                              "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
                              3⤵
                              • Reads the TCP/IP host and domain name from the registry
                              • Suspicious use of SetWindowsHookEx
                              PID:8036
                              • C:\Windows\SYSTEM32\cmd.exe
                                cmd.exe /c start "" C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                                4⤵
                                • Executes a command shell one-liner
                                PID:8076
                                • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                                  C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                                  5⤵
                                  • Reads the TCP/IP host and domain name from the registry
                                  • Suspicious use of SetWindowsHookEx
                                  PID:8132
                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\bin\java.exe
                                    C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\bin\java.exe -Dsun.java2d.uiScale.enabled=false -Xmx1536m -Dfile.encoding=UTF8 -Djava.net.preferIPv4Stack=true --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.desktop/java.awt=ALL-UNNAMED --add-opens=java.desktop/sun.awt.image=ALL-UNNAMED --add-opens=java.desktop/sun.java2d=ALL-UNNAMED --add-opens=java.desktop/java.awt.color=ALL-UNNAMED --add-opens=java.desktop/java.awt.image=ALL-UNNAMED --add-opens=java.desktop/com.apple.eawt=ALL-UNNAMED --add-opens=java.base/java.util.regex=ALL-UNNAMED --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.desktop/java.beans=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.network=ALL-UNNAMED --add-opens=javafx.web/javafx.scene.web=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.event=ALL-UNNAMED -cp C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\annotations-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aopalliance-1.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\arns-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\auth-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-query-protocol-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-xml-protocol-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checker-qual-3.12.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checksums-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checksums-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-compress-1.23.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-io-2.11.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-lang3-3.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-1.1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-api-1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-vfs2-2.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\crt-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\desktop-common-util-1.269-java21.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\DiscordIPC-0.5.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\dnsjava-2.1.8.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\endpoints-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\error_prone_annotations-2.18.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\eventstream-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\failureaccess-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\filters-2.0.235.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\gson-2.13.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guava-31.0.1-jre.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-assistedinject-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-aws-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-aws-eventstream-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-client-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-download-1.269-java21.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpclient5-5.6.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpclient5-fluent-5.6.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpcore5-5.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpcore5-h2-5.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\identity-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\j2objc-annotations-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jackson-annotations-2.13.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jakarta.inject-api-2.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\java-image-scaling-0.8.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javax.annotation-api-1.3.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-api-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-core-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-impl-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jcl-over-slf4j-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-20230227.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-utils-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jsr305-3.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-native-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junrar-0.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\log4j-1.2.17.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-classic-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-core-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\lombok-1.18.30.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-api-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svn-commons-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svnexe-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\metrics-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\MinecraftServerPing-1.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\mockserver-netty-no-dependencies-5.14.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\modpack-dto-2.283.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\picture-bundle-3.73.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\plexus-utils-1.5.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\profiles-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\protocol-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\reactive-streams-1.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regexp-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regions-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\retries-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\retries-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\s3-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\sdk-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\skin-api-1.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\slf4j-api-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\statistics-dto-1.73.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\third-party-jackson-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\tlauncher-resource-1.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\utils-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\utils-lite-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\xz-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\original-TLauncher-2.9378.jar; org.tlauncher.tlauncher.rmo.TLauncher -starterConfig=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\starter.json -requireUpdate=false -currentAppVersion=2.9378 -starterDomainAvailabilityV1=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\domainAvailabilityV1.json -country=${country} -starterJVM= -starterWorkingDirectory=C:\Users\Admin\AppData\Local\Temp -starterJarFile=C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe -starterFileEncoding=UTF-8 -runVersionWithServer=empty
                                    6⤵
                                    • Reads the TCP/IP host and domain name from the registry
                                    • System Network Configuration Discovery: Internet Connection Discovery
                                    • System Time Discovery
                                    • Checks processor information in registry
                                    • Suspicious use of SetWindowsHookEx
                                    PID:8044
                                    • C:\Windows\SYSTEM32\cmd.exe
                                      cmd.exe /C "chcp 437 & wmic CPU get NAME"
                                      7⤵
                                      • Executes a command shell one-liner
                                      PID:7776
                                      • C:\Windows\system32\chcp.com
                                        chcp 437
                                        8⤵
                                          PID:9124
                                        • C:\Windows\System32\Wbem\WMIC.exe
                                          wmic CPU get NAME
                                          8⤵
                                          • Reads the TCP/IP host and domain name from the registry
                                          PID:8740
                                      • C:\Windows\SYSTEM32\cmd.exe
                                        cmd.exe /C "chcp 437 & cmd.exe /c set processor"
                                        7⤵
                                        • Executes a command shell one-liner
                                        PID:6620
                                        • C:\Windows\system32\chcp.com
                                          chcp 437
                                          8⤵
                                            PID:6308
                                          • C:\Windows\system32\cmd.exe
                                            cmd.exe /c set processor
                                            8⤵
                                            • Executes a command shell one-liner
                                            PID:6388
                                        • C:\Windows\SYSTEM32\cmd.exe
                                          cmd.exe /C "chcp 437 & dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.tlauncher\logs\tlauncher\dxdiag.txt"
                                          7⤵
                                          • Executes a command shell one-liner
                                          PID:9188
                                          • C:\Windows\system32\chcp.com
                                            chcp 437
                                            8⤵
                                              PID:5824
                                            • C:\Windows\system32\dxdiag.exe
                                              dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.tlauncher\logs\tlauncher\dxdiag.txt
                                              8⤵
                                              • Drops file in System32 directory
                                              • Checks SCSI registry key(s)
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of SetWindowsHookEx
                                              PID:7460
                                          • C:\Windows\SYSTEM32\cmd.exe
                                            cmd.exe /C "chcp 437 & wmic qfe get HotFixID"
                                            7⤵
                                            • Executes a command shell one-liner
                                            PID:1992
                                            • C:\Windows\system32\chcp.com
                                              chcp 437
                                              8⤵
                                                PID:5500
                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                wmic qfe get HotFixID
                                                8⤵
                                                • Reads the TCP/IP host and domain name from the registry
                                                PID:5980
                                            • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\bin\javaw.exe
                                              C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\bin\javaw.exe "-Dos.name=Windows 10" -Dos.version=10.0 -Dfml.ignoreInvalidMinecraftCertificates=true -Dfml.ignorePatchDiscrepancies=true -Djava.net.preferIPv4Stack=true -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Xss1M -XX:StackShadowPages=32 --enable-native-access=ALL-UNNAMED --add-exports java.base/jdk.internal.misc=ALL-UNNAMED -Djava.library.path=C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.3\natives/java -Djna.tmpdir=C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.3\natives/jna -Dorg.lwjgl.system.SharedLibraryExtractPath=C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.3\natives/lwjgl -Dio.netty.native.workdir=C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.3\natives/netty -Dminecraft.launcher.brand=minecraft-launcher -Dminecraft.launcher.version=2.3.173 -cp C:\Users\Admin\AppData\Roaming\.minecraft\libraries\at\yawk\lz4\lz4-java\1.10.1\lz4-java-1.10.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\azure\azure-json\1.4.0\azure-json-1.4.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\github\oshi\oshi-core\6.9.0\oshi-core-6.9.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\code\gson\gson\2.14.0\gson-2.14.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\failureaccess\1.0.3\failureaccess-1.0.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\guava\33.6.0-jre\guava-33.6.0-jre.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\ibm\icu\icu4j\78.3\icu4j-78.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\microsoft\azure\msal4j\1.24.1\msal4j-1.24.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\authlib\10.0.77\authlib-10.0.77.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\blocklist\1.0.10\blocklist-1.0.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\brigadier\1.3.11\brigadier-1.3.11.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\datafixerupper\10.0.21\datafixerupper-10.0.21.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\jtracy\1.14.38\jtracy-1.14.38.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\jtracy\1.14.38\jtracy-1.14.38-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\logging\1.7.12\logging-1.7.12.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\tlauncher\patchy\2.2.101\patchy-2.2.101.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\text2speech\1.19.12\text2speech-1.19.12.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-codec\commons-codec\1.22.0\commons-codec-1.22.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-io\commons-io\2.20.0\commons-io-2.20.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-buffer\4.2.16.Final\netty-buffer-4.2.16.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-codec-base\4.2.16.Final\netty-codec-base-4.2.16.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-codec-compression\4.2.16.Final\netty-codec-compression-4.2.16.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-codec-http\4.2.16.Final\netty-codec-http-4.2.16.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-common\4.2.16.Final\netty-common-4.2.16.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-handler\4.2.16.Final\netty-handler-4.2.16.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-resolver\4.2.16.Final\netty-resolver-4.2.16.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-classes-epoll\4.2.16.Final\netty-transport-classes-epoll-4.2.16.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-classes-kqueue\4.2.16.Final\netty-transport-classes-kqueue-4.2.16.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-native-unix-common\4.2.16.Final\netty-transport-native-unix-common-4.2.16.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport\4.2.16.Final\netty-transport-4.2.16.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\it\unimi\dsi\fastutil\8.5.18\fastutil-8.5.18.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\java\dev\jna\jna-platform\5.17.0\jna-platform-5.17.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\java\dev\jna\jna\5.17.0\jna-5.17.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\sf\jopt-simple\jopt-simple\5.0.4\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\commons\commons-compress\1.28.0\commons-compress-1.28.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\commons\commons-lang3\3.20.0\commons-lang3-3.20.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-api\2.26.0\log4j-api-2.26.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-core\2.26.0\log4j-core-2.26.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-slf4j2-impl\2.26.0\log4j-slf4j2-impl-2.26.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\jcraft\jorbis\0.0.17\jorbis-0.0.17.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\joml\joml\1.10.9\joml-1.10.9.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\jspecify\jspecify\1.0.0\jspecify-1.0.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.4.3\lwjgl-freetype-3.4.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.4.3\lwjgl-freetype-3.4.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.4.3\lwjgl-freetype-3.4.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.4.3\lwjgl-jemalloc-3.4.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.4.3\lwjgl-jemalloc-3.4.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.4.3\lwjgl-jemalloc-3.4.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.4.3\lwjgl-openal-3.4.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.4.3\lwjgl-openal-3.4.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.4.3\lwjgl-openal-3.4.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.4.3\lwjgl-opengl-3.4.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.4.3\lwjgl-opengl-3.4.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.4.3\lwjgl-opengl-3.4.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-sdl\3.4.3\lwjgl-sdl-3.4.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-sdl\3.4.3\lwjgl-sdl-3.4.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-sdl\3.4.3\lwjgl-sdl-3.4.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-shaderc\3.4.3\lwjgl-shaderc-3.4.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-shaderc\3.4.3\lwjgl-shaderc-3.4.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-shaderc\3.4.3\lwjgl-shaderc-3.4.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-spvc\3.4.3\lwjgl-spvc-3.4.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-spvc\3.4.3\lwjgl-spvc-3.4.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-spvc\3.4.3\lwjgl-spvc-3.4.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.4.3\lwjgl-stb-3.4.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.4.3\lwjgl-stb-3.4.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.4.3\lwjgl-stb-3.4.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-vma\3.4.3\lwjgl-vma-3.4.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-vma\3.4.3\lwjgl-vma-3.4.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-vma\3.4.3\lwjgl-vma-3.4.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-vulkan\3.4.3\lwjgl-vulkan-3.4.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.4.3\lwjgl-3.4.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.4.3\lwjgl-3.4.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.4.3\lwjgl-3.4.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\slf4j\slf4j-api\2.0.17\slf4j-api-2.0.17.jar;C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.3\26.3.jar -Xms2G -XX:+UseCompactObjectHeaders -XX:+AlwaysPreTouch -XX:+UseStringDeduplication -XX:+UseZGC -Dminecraft.applet.TargetDirectory=C:\Users\Admin\AppData\Roaming\.minecraft -DlibraryDirectory=C:\Users\Admin\AppData\Roaming\.minecraft\libraries -Dcountry=${country} -Dlog4j.configurationFile=C:\Users\Admin\AppData\Roaming\.minecraft\assets\log_configs\client-1.21.2.xml -Xmx10922M net.minecraft.client.main.Main --username wwwww --version 26.3 --gameDir C:\Users\Admin\AppData\Roaming\.minecraft --assetsDir C:\Users\Admin\AppData\Roaming\.minecraft\assets --assetIndex 34 --uuid 7bbee4dea3f54234abb159a4da794a47 --accessToken null --clientId null --xuid null --versionType release --width 925 --height 530
                                              7⤵
                                              • Reads the TCP/IP host and domain name from the registry
                                              • Checks processor information in registry
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4000
                                • C:\Windows\system32\vssvc.exe
                                  C:\Windows\system32\vssvc.exe
                                  1⤵
                                  • Checks SCSI registry key(s)
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3796
                                • C:\Windows\system32\srtasks.exe
                                  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                  1⤵
                                    PID:3096
                                  • C:\Windows\system32\msiexec.exe
                                    C:\Windows\system32\msiexec.exe /V
                                    1⤵
                                    • Enumerates connected drives
                                    • Drops file in System32 directory
                                    • Drops file in Windows directory
                                    • Modifies data under HKEY_USERS
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5008
                                  • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                    "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
                                    1⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:4040
                                    • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                      "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261001123755.log"
                                      2⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:2540
                                      • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                        "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261001123755.log"
                                        3⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of WriteProcessMemory
                                        PID:3876
                                        • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                          "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{3B3E54E7-732F-490A-AB2E-099C50494590} {E1C5EB70-EB97-42B9-A238-446D0F97C8C5} 3876
                                          4⤵
                                          • Adds Run key to start application
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          PID:680
                                  • C:\Windows\system32\wbem\unsecapp.exe
                                    C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                    1⤵
                                      PID:4356
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --autostart
                                      1⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of WriteProcessMemory
                                      PID:5416
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x12c,0x130,0x134,0x128,0x138,0x7ffe9435ec30,0x7ffe9435ec40,0x7ffe9435ec50
                                        2⤵
                                        • Executes dropped EXE
                                        PID:5672
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe7FAE56220944838BCDB933E86AD23A432FE91C0ADA84DF94778C72EE141B2B1F
                                      1⤵
                                      • Reads the TCP/IP host and domain name from the registry
                                      • Enumerates system info in registry
                                      PID:400
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x280,0x284,0x288,0x218,0x28c,0x7ff776366598,0x7ff7763665a8,0x7ff7763665b8
                                        2⤵
                                          PID:8608
                                        • C:\Users\Admin\AppData\Local\Temp\.opera\9B44A87EC5AC\installer.exe
                                          "C:\Users\Admin\AppData\Local\Temp\.opera\9B44A87EC5AC\installer.exe" --version
                                          2⤵
                                            PID:7308

                                        Network

                                              MITRE ATT&CK Enterprise v16

                                              Reconnaissance

                                              Resource Development

                                              Initial Access

                                              Execution

                                              Command and Scripting Interpreter

                                              1
                                              T1059

                                              Windows Command Shell

                                              1
                                              T1059.003

                                              Persistence

                                              Boot or Logon Autostart Execution

                                              1
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Event Triggered Execution

                                              1
                                              T1546

                                              Component Object Model Hijacking

                                              1
                                              T1546.015

                                              Hijack Execution Flow

                                              1
                                              T1574

                                              DLL Search Order Hijacking

                                              1
                                              T1574.001

                                              Privilege Escalation

                                              Boot or Logon Autostart Execution

                                              1
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Event Triggered Execution

                                              1
                                              T1546

                                              Component Object Model Hijacking

                                              1
                                              T1546.015

                                              Hijack Execution Flow

                                              1
                                              T1574

                                              DLL Search Order Hijacking

                                              1
                                              T1574.001

                                              Defense Evasion

                                              Hijack Execution Flow

                                              1
                                              T1574

                                              DLL Search Order Hijacking

                                              1
                                              T1574.001

                                              Masquerading

                                              1
                                              T1036

                                              Match Legitimate Name or Location

                                              1
                                              T1036.005

                                              Modify Registry

                                              3
                                              T1112

                                              Subvert Trust Controls

                                              1
                                              T1553

                                              Install Root Certificate

                                              1
                                              T1553.004

                                              Credential Access

                                              Credentials from Password Stores

                                              1
                                              T1555

                                              Credentials from Web Browsers

                                              1
                                              T1555.003

                                              Unsecured Credentials

                                              1
                                              T1552

                                              Credentials In Files

                                              1
                                              T1552.001

                                              Discovery

                                              Network Share Discovery

                                              1
                                              T1135

                                              Peripheral Device Discovery

                                              2
                                              T1120

                                              Query Registry

                                              6
                                              T1012

                                              System Information Discovery

                                              5
                                              T1082

                                              System Location Discovery

                                              1
                                              T1614

                                              System Language Discovery

                                              1
                                              T1614.001

                                              System Network Configuration Discovery

                                              2
                                              T1016

                                              Internet Connection Discovery

                                              1
                                              T1016.001

                                              System Time Discovery

                                              1
                                              T1124

                                              Lateral Movement

                                              Collection

                                              Data from Local System

                                              1
                                              T1005

                                              Command and Control

                                              Exfiltration

                                              Impact

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              e59cdcb.rbs
                                              • Path C:\Config.Msi\e59cdcb.rbs
                                              • Size 19KB
                                              • SHA256 e9e8e1cf303beafceed1ad925621fb333de1be94ae9a21a2b38156a3bbc5e3dc
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              e59cdd7.rbs
                                              • Path C:\Config.Msi\e59cdd7.rbs
                                              • Size 19KB
                                              • SHA256 bbe3717db12fe72e9b4954cee6e31e5aee66cdd86abe52e64d9897ad557d0f32
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              e59cdde.rbs
                                              • Path C:\Config.Msi\e59cdde.rbs
                                              • Size 21KB
                                              • SHA256 037ce741e13bf5f2e339cbf954591e9949ed75dac708904ffaa5fb3fc2838720
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              e59cded.rbs
                                              • Path C:\Config.Msi\e59cded.rbs
                                              • Size 21KB
                                              • SHA256 afc303aa41fa2cb052d6c00fb6032dfb3adf5ffd2b34348ba4db5a88d8de1282
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              state.rsm
                                              • Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
                                              • Size 1024B
                                              • SHA256 7fa6a3e8a950fe894529a2a6ba29b05d7d8e5b6bdbf349711f7e7c7f88d8e6e7
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                              • Size 471B
                                              • SHA256 8b59ffaf49a6819229547efe480edc277295a5645954248da7539380f74cebfa
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                              • Size 416B
                                              • SHA256 32cbb0a9d6c8dedfd4ee0e9428c9e3024955d9689cc6c253552dad8f1b26b608
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              data_1
                                              • Path C:\Users\Admin\AppData\Local\Opera Software\Opera GX Stable\Default\System Cache\Cache_Data\data_1
                                              • Size 264KB
                                              • SHA256 e78309cf7ba9805a6b61b3ee34ad882437382982ae1d61a1fcd24a9183e5ea7d
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              installer.exe
                                              • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe
                                              • Size 9.2MB
                                              • SHA256 cdd0be1bf1c6f5b28085cb391f4a7027725c8f37e20d4319f55835e7dd21c98f
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              custom_partner_content.json
                                              • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\resources\custom_partner_content.json
                                              • Size 245KB
                                              • SHA256 84bc1efb211c6b45f2906278a36f1414922f994a9611bbee7713ffd4ae21e967
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              opera_autoupdate.exe
                                              • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                              • Size 7.4MB
                                              • SHA256 bb2808ef3e626d3271b4714060280904cb27ebe5d09895142731b247f686979d
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              installer_prefs.json
                                              • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\installer_prefs.json
                                              • Size 1KB
                                              • SHA256 cce6a5772938afaf438d94a3f029b59fa38b3442f3820fb57209c05974a3b7fd
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              opera.exe
                                              • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                              • Size 3.4MB
                                              • SHA256 98aee9718f253d3c1bb069b020b5492489eba534e0280257d6b2eb38b32340b5
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              +JXF18093567058759332561.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\+JXF18093567058759332561.tmp
                                              • Size 141KB
                                              • SHA256 b2efabca5ea4bc56eea829713706b5cd0788b82aca153bd4adde9b1573933b4f
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              +JXF457288271202608577.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\+JXF457288271202608577.tmp
                                              • Size 477KB
                                              • SHA256 a4ece920f221b78d43b550d615c5934db162b64a331ffa663a85199e74ef2e6b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              +JXF6277496311662405865.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\+JXF6277496311662405865.tmp
                                              • Size 424KB
                                              • SHA256 83ff53f599acefc11f5cf63fd0516d4db72aacf7f0125a5f79c9ff222cbf9dd7
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              +JXF8860682121401814195.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\+JXF8860682121401814195.tmp
                                              • Size 132KB
                                              • SHA256 9287925cae90ac480804094ff0876832065e2db116470da1f524d79ed9c18b70
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Opera GX Browser.lnk
                                              • Path C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581\Opera GX Browser.lnk
                                              • Size 1KB
                                              • SHA256 d993be39ed70c8f419f0b233aa234e4b2d3320a5444a8f0fae8a46dce97e16dc
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581\assistant\Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe
                                              • Size 2.9MB
                                              • SHA256 cdb600359a2ee392e9ff11e680770171531760b6d64319cf6bffc5c1341a0dc0
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              assistant_installer.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581\assistant\assistant_installer.exe
                                              • Size 2.5MB
                                              • SHA256 5dda5f3ca9e230e79dc6c74ab74afe8d027cbd4db293ab0260dcf71010f6ff9b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              dbgcore.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581\assistant\dbgcore.dll
                                              • Size 196KB
                                              • SHA256 0a08d02dbba60e940694a2c154d4b78969df546d40d8ec314cf6be1753f009d1
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              dbghelp.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581\assistant\dbghelp.dll
                                              • Size 1.8MB
                                              • SHA256 bb4c23816f445ae5122ba5fc7d8cdd77bb9e519ab107f450320829a98df52175
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              installer_prefs_include.json
                                              • Path C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581\installer_prefs_include.json
                                              • Size 242B
                                              • SHA256 40ea1fbf69784552a6aca6f03f95b7ec4c38332d39c88322835c70b661d643dd
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              installer_prefs_include.json
                                              • Path C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581\installer_prefs_include.json
                                              • Size 977B
                                              • SHA256 90d0217d94135b5a601875da97bb1298d588f6dba111d5d812baa6d16ad0d195
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              installer_prefs_include.json.backup
                                              • Path C:\Users\Admin\AppData\Local\Temp\.opera\76727d92-1b25-4911-95ee-5d56c8547254 Opera GX Installer Temp\opera_package_202610011237581\installer_prefs_include.json.backup
                                              • Size 227B
                                              • SHA256 97331f17409895395d817dd6dab7119ff107665a9f866a3c2926bfa9ada6b1b7
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              11046850-ee97-41d3-ac0c-4eb156a554ad.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\11046850-ee97-41d3-ac0c-4eb156a554ad.tmp
                                              • Size 13KB
                                              • SHA256 ce8adf970c3290b7ea94c85727c5abe7eb232e16026a1f8f876ad7f3ec03573d
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              3b20ed8f-258b-4255-83ea-5f5d3cdcc789.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\3b20ed8f-258b-4255-83ea-5f5d3cdcc789.tmp
                                              • Size 472KB
                                              • SHA256 4b9b79291aca9c45d54ae238655f41b7a0eecb0b80fb3d172cd0b1d75e712540
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              5c3de0a2-9f8d-4f0a-8408-5e881b921535.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\5c3de0a2-9f8d-4f0a-8408-5e881b921535.tmp
                                              • Size 4.6MB
                                              • SHA256 e81986014a4fb55c0aa220745d2433c51ad29166b32693de8911784dd3920584
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              installer.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS03E89A69\installer.exe
                                              • Size 9.2MB
                                              • SHA256 2511fbf843679b4d8070f3ee4360abab2420ba0dc5f359faecb724e51c6dffe6
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              200.ico
                                              • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
                                              • Size 116KB
                                              • SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              IRIMG1.BMP
                                              • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP
                                              • Size 12KB
                                              • SHA256 1d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              IRIMG11.PNG
                                              • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG11.PNG
                                              • Size 43KB
                                              • SHA256 b162a410c0cf0c47a5487fd0048311a5c782f83568af85b1f9bb896beb0c22f4
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              IRIMG12.PNG
                                              • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG12.PNG
                                              • Size 644B
                                              • SHA256 b8f5949b393f1c94e522bbed6c4f91bf273ffa23ecae17a3248e822e8b7f6628
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              IRIMG14.PNG
                                              • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG14.PNG
                                              • Size 40KB
                                              • SHA256 7e39befa8fec0b4f6a71cc46b49b2a7aa6819410351b1c9b405f700e857b071f
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              IRIMG2.BMP
                                              • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP
                                              • Size 12KB
                                              • SHA256 9c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              IRIMG3.BMP
                                              • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP
                                              • Size 12KB
                                              • SHA256 4c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              IRIMG4.BMP
                                              • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG4.BMP
                                              • Size 451KB
                                              • SHA256 64da5bd044908b2c3a725c5a55edec1644be498f41ea05d42a6ae8cd797f1d80
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              IRIMG7.PNG
                                              • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG7.PNG
                                              • Size 438B
                                              • SHA256 5252a4f2519c4c215a7d82ee5f2fe5752ed9604fcf5bf90cc98af1448faf881b
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              IRZip.lmd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
                                              • Size 400KB
                                              • SHA256 4776d4c121e2294f1e6bca5a89525e4a451190c218244a1e34bcbf9f65b18fa5
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              TL-INSTALLER.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\TL-INSTALLER.exe
                                              • Size 3.8MB
                                              • SHA256 b6c92b1826f3804c40db9b2adb0350ffc5eec8ce914c6435d0d9b09d34ebad71
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Wow64.lmd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
                                              • Size 252KB
                                              • SHA256 27b48727237cd0f8a1205e01e5c93cbe6c7a2f3938faf8d8daa5191094c347a5
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              irsetup.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                              • Size 1.7MB
                                              • SHA256 81b2e287246cfa5dea40c9589ac32406a4b65f593cae31d65034551399b4be2e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              lua5.3.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
                                              • Size 395KB
                                              • SHA256 22eb6f08accb3c20caa7a7240aa094467204918d2a797b5c6905bea3f2361677
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              vc_redist.x64.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\vc2015_22\vc_redist.x64.exe
                                              • Size 24.4MB
                                              • SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              irsetup.dat
                                              • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat
                                              • Size 141KB
                                              • SHA256 4f828417b19fde177b896434400e27898981f5ba8a0fd5ec38723a53a6ea11a8
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              irsetup.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                              • Size 1.7MB
                                              • SHA256 312a85758f022b0ec26c858f5ef493be5f9bc2ef2f383ccb323d7d4c25261316
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              d9eb9efa-a9df-43da-aee2-b57cb41c5f90.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\d9eb9efa-a9df-43da-aee2-b57cb41c5f90.tmp
                                              • Size 2.6MB
                                              • SHA256 19bc35ca347a6560c0183e56da6bee3353737e78aa9eff9111c5ebd897b0cfd5
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              da99a87e-dfa2-402c-bff1-8dbaa030e7b6.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\da99a87e-dfa2-402c-bff1-8dbaa030e7b6.tmp
                                              • Size 1.2MB
                                              • SHA256 9cc80630179e77c7425346c110a59c7de35b5b000253dd322c7853867fbe3316
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              dd_vcredist_amd64_20261001123755.log
                                              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261001123755.log
                                              • Size 19KB
                                              • SHA256 b024e875e6a33859094279bf781e632f1af81beacc547e76ef6734461ab06756
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              dd_vcredist_amd64_20261001123755_000_vcRuntimeMinimum_x64.log
                                              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261001123755_000_vcRuntimeMinimum_x64.log
                                              • Size 4KB
                                              • SHA256 3cb697a54c0b77d149f05b022be3224e0ec7c603ca7b5855ceded4e577c292cf
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              dd_vcredist_amd64_20261001123755_001_vcRuntimeAdditional_x64.log
                                              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261001123755_001_vcRuntimeAdditional_x64.log
                                              • Size 31KB
                                              • SHA256 5dadaad0f433779ed65bb3fd5b03d3a2cfe6c1c8a8386d322c262ca818bcb0b9
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              fdcab142-0895-40c1-a66e-5a435aa18c0f.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\fdcab142-0895-40c1-a66e-5a435aa18c0f.tmp
                                              • Size 46KB
                                              • SHA256 176a736c95c08746480a0e25f7acf323d502d0f6aac4b4dfbeb2713513af8a52
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              opera-installer-bro.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                              • Size 4.0MB
                                              • SHA256 3e4044988d8fdcce3bb3f5db78f83dfea4097e3899941ca09b972e49a850ea0e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Icon_Light_Neutral.png
                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1604_1448912668\CRX_INSTALL\icons\128\Icon_Light_Neutral.png
                                              • Size 2KB
                                              • SHA256 ec33dffd3fdb927141385a8c8eefb5fdfbd6dec9b50dfa02d66aa6377342bce2
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              setuparguments.ini
                                              • Path C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
                                              • Size 797B
                                              • SHA256 3210dd0c4bc108457d8587d63a589f65ec5d0d20164539847a1b628061b171dd
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              d7caa0e3aa5eb656c51817ae4bfbf3c4d72cdaad.tlauncherdownload
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\assets\objects\d7\d7caa0e3aa5eb656c51817ae4bfbf3c4d72cdaad.tlauncherdownload
                                              • Size 98KB
                                              • SHA256 65388145333f6ceffe2be67790183a77d45b97236248ac1eab3befe6a17979d7
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              d98bfe156cd935db5a3a45b980c7f86ed9bcab59.tlauncherdownload
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\assets\objects\d9\d98bfe156cd935db5a3a45b980c7f86ed9bcab59.tlauncherdownload
                                              • Size 550KB
                                              • SHA256 6633244fdd649c1512169d6f439e3a3f08d437f543aae3ca432f72880eb93b83
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              jopt-simple-5.0.4.jar
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\sf\jopt-simple\jopt-simple\5.0.4\jopt-simple-5.0.4.jar
                                              • Size 76KB
                                              • SHA256 df26cc58f235f477db07f753ba5a3ab243ebe5789d9f89ecf68dd62ea9a66c28
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              client.jar
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\libraries\v1\objects\e877b6a07acd633fb3bb475002175cec036e7b87\client.jar
                                              • Size 39.6MB
                                              • SHA256 4508d006323f24fa02876310c192d739af56516eb259000ac50f0909a68c9a2d
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              javaw.exe
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\bin\javaw.exe
                                              • Size 39KB
                                              • SHA256 38ac81b6ef29e4f29235902fe56385e3c2e4f216f728baff9512aae4e5c7bc67
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              net.properties
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\net.properties
                                              • Size 7KB
                                              • SHA256 594bc40230a0bd7c441fe069989d66e534a6bae2ee5910f9f4bf64e59b583256
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              README.txt
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\security\policy\README.txt
                                              • Size 2KB
                                              • SHA256 6da0747334b0fea7592fd92614b2bbc8b126535e129b1fee483774d914e98eb5
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              default_US_export.policy.tlauncherdownload
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\security\policy\limited\default_US_export.policy.tlauncherdownload
                                              • Size 146B
                                              • SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              default_local.policy
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\security\policy\limited\default_local.policy
                                              • Size 647B
                                              • SHA256 2b2627548e61316150d47ffc3e6cad465ca05b3cccd4785eb7d21aa7baa0f441
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              exempt_local.policy
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\security\policy\limited\exempt_local.policy
                                              • Size 566B
                                              • SHA256 8c3d7648abcd95a272ce12db870082937f4d7f6878d730d83cb7fbb31eb8b2c9
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              default_local.policy
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\security\policy\unlimited\default_local.policy
                                              • Size 193B
                                              • SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              sound.properties
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\conf\sound.properties
                                              • Size 1KB
                                              • SHA256 299c2360b6155eb28990ec49cd21753f97e43442fe8fab03e04f3e213df43a66
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ADDITIONAL_LICENSE_INFO
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\ADDITIONAL_LICENSE_INFO
                                              • Size 2KB
                                              • SHA256 a69bce275ba7a3570af6579cb0f55682cd75fedfcd49e0e8e9022270c447c916
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              LICENSE
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\LICENSE
                                              • Size 18KB
                                              • SHA256 4b9abebc4338048a7c2dc184e9f800deb349366bdf28eb23c2677a77b4c87726
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              aes.md
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\aes.md
                                              • Size 1KB
                                              • SHA256 45c6d4da48325edfbff3dcf71c704e504c057904435ed23c6d57046d551eb69d
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              c-libutl.md
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\c-libutl.md
                                              • Size 1KB
                                              • SHA256 bef40679922d6fdfb7e4ddb223ad6722300f6054ba737bbf6188d60fcec517f9
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              siphash.md.tlauncherdownload
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\siphash.md.tlauncherdownload
                                              • Size 8KB
                                              • SHA256 5a792b5a74ad2a5f3d6a7ad8b7a841116e58a772c18bc6e392320a365b222c76
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              wepoll.md
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\wepoll.md
                                              • Size 1KB
                                              • SHA256 3ac2992770080453b98c42afa807ba4b2c1738ef756b92a55c645f55e7df48f0
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              zlib.md
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.base\zlib.md
                                              • Size 1010B
                                              • SHA256 809b62ba648e02302f7d9ea6b6886c10d5253ac86ad528038a50c73eada5fce2
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ADDITIONAL_LICENSE_INFO.tlauncherdownload
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.datatransfer\ADDITIONAL_LICENSE_INFO.tlauncherdownload
                                              • Size 48B
                                              • SHA256 d255311b0a181e243de326d111502a8b1dc7277b534a295a8340ab5230e74c83
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              ASSEMBLY_EXCEPTION.tlauncherdownload
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.datatransfer\ASSEMBLY_EXCEPTION.tlauncherdownload
                                              • Size 43B
                                              • SHA256 7901499314e881a978d80a31970f0daec92d4995f3305e31fb53c38d9cc6ec3b
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              LICENSE.tlauncherdownload
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.datatransfer\LICENSE.tlauncherdownload
                                              • Size 32B
                                              • SHA256 d60635c89c9f352ae1e66ef414344f290f5b5f7ce5c23d9633d41fde0909df80
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              colorimaging.md
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.desktop\colorimaging.md
                                              • Size 167B
                                              • SHA256 04d61e3e8e71dd452ebe52008af5378d9f6640d14578aeb515dc5375973b0189
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              harfbuzz.md
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.desktop\harfbuzz.md
                                              • Size 3KB
                                              • SHA256 b3f327a8b36d56beb152b3fd1bb5a7f245362cbea123ebbc68f8907f741b552a
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              jpeg.md
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.desktop\jpeg.md
                                              • Size 3KB
                                              • SHA256 c1dfb9719a71ad9f861f8728550542d681e25c8ef40e6393606e6e2a0c1d653a
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              mesa3d.md
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.desktop\mesa3d.md
                                              • Size 5KB
                                              • SHA256 63f4e6f75caebbccb95d903fb43e46ac7111b3624d0a34f146b276d7d9e7b152
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              santuario.md
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.xml.crypto\santuario.md
                                              • Size 11KB
                                              • SHA256 d08690d25f660f145c73365d260ed522cd0aace8a0e1396706551b7a1ae8c9a3
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              dom.md
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.xml\dom.md
                                              • Size 3KB
                                              • SHA256 6686e8877667584a3a7c07344baadca1a03e29f677162d87c3c0811e990d1148
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              jcup.md
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.xml\jcup.md
                                              • Size 1KB
                                              • SHA256 8d5dcfdf50455a3c34c753a98f21e953248af200415a9084e3f102cb6c43b8bf
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              xalan.md
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.xml\xalan.md
                                              • Size 13KB
                                              • SHA256 02bd013fc3f438dbb8fa41fa57888177e015efa6431d37fce6e794c6f353a6a1
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              xerces.md
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\java.xml\xerces.md
                                              • Size 11KB
                                              • SHA256 4a6bf6b367193ee68681cb2d9fed30ffc5d62dd2d477bd62e0271707d71b3244
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              pkcs11cryptotoken.md
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\jdk.crypto.cryptoki\pkcs11cryptotoken.md
                                              • Size 3KB
                                              • SHA256 1f36ff1342a581142c858f90064e20633d43529ac82adb85345bd902a14e18b2
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              pkcs11wrapper.md
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\legal\jdk.crypto.cryptoki\pkcs11wrapper.md
                                              • Size 2KB
                                              • SHA256 371974b1fca3744a3892c7ee1fcc593b8b4281fc218f4cafd2f709e9df5fd81d
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              fontconfig.bfc
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\lib\fontconfig.bfc
                                              • Size 4KB
                                              • SHA256 c7e2e76b908cb6330823e698889943c162e9861a4575501cbb59c9b830158ab0
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              jvm.cfg
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows\java-runtime-epsilon\lib\jvm.cfg
                                              • Size 29B
                                              • SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              OpenAL.dll
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.3\natives\lwjgl\3.4.3+4\x64\OpenAL.dll
                                              • Size 1.9MB
                                              • SHA256 ff0671cba224947ddfd5d338ebc1f8ce502be7aea5cbd599d46cd74473dea0e3
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              SDL3.dll
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.3\natives\lwjgl\3.4.3+4\x64\SDL3.dll
                                              • Size 2.8MB
                                              • SHA256 292406def58d7771919eeae8d55a79d1b42657c8e0176b0602eb97ee796786c9
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              freetype.dll
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.3\natives\lwjgl\3.4.3+4\x64\freetype.dll
                                              • Size 2.2MB
                                              • SHA256 fcac5b5a9a8977f1bc76eccea5e71f6c57250ca5ab8605f06906377e91b6e6b7
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              jemalloc.dll
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.3\natives\lwjgl\3.4.3+4\x64\jemalloc.dll
                                              • Size 391KB
                                              • SHA256 89cfeffe72f01d3634ab4adf7e1597a4a502b463c0472ebfa483b9b41f0ee130
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              lwjgl.dll
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.3\natives\lwjgl\3.4.3+4\x64\lwjgl.dll
                                              • Size 519KB
                                              • SHA256 15b82b77f3a584b8df9e95899a908fb825cfac80a3ebd78ace0eb473a1069121
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              lwjgl_opengl.dll
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.3\natives\lwjgl\3.4.3+4\x64\lwjgl_opengl.dll
                                              • Size 355KB
                                              • SHA256 834013019ef4fc203243a7c1d4e0b8c2c49d134ce156780a6d2af424da49d2f1
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              lwjgl_stb.dll
                                              • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.3\natives\lwjgl\3.4.3+4\x64\lwjgl_stb.dll
                                              • Size 593KB
                                              • SHA256 cfb4b0c0fc34a0efe7632e76581cba05b489059e2061c1ce164fb4c32ec79547
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              InnerStateServer-1.3.json
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\InnerStateServer-1.3.json
                                              • Size 2B
                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              IRIMG1.PNG
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.PNG
                                              • Size 45KB
                                              • SHA256 4d82d90aa27c7f906f6094c90ad3e185b058efafb9b2c21975b0ea2db76362df
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              IRIMG10.PNG
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG10.PNG
                                              • Size 41KB
                                              • SHA256 f0cffd9d34649b620d7279b2068e420495079f23f66319e36110360f3e875aa0
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              IRIMG3.PNG
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG3.PNG
                                              • Size 475B
                                              • SHA256 3642e6bc8cfac59803bbb7a79617886677f496cced89f5746ee5ffc466513e36
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              IRIMG4.PNG
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG
                                              • Size 368B
                                              • SHA256 ec86b96018d9ef2656af9303c1e9bde952281fe422f0d1596843328b07952d36
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              IRIMG45.BMP
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG45.BMP
                                              • Size 451KB
                                              • SHA256 b4f43d08629236cd31224d7f1f8d3724c540db219a75eb0c6a4890cd0c691ea6
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              IRIMG8.PNG
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG8.PNG
                                              • Size 206B
                                              • SHA256 b8635c896dc08f78667cb30b5bdd1144059bf5e67a2a483fdfbd46ced69a8cdf
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              uninstall.xml
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                              • Size 4KB
                                              • SHA256 86306e5b34812502569bbf0eefaf7859d83a7788ed1242a82fe15611e2f9a02b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              uninstall.xml
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                              • Size 4KB
                                              • SHA256 d22b431ab4774849261607296d1998e449798bfb1fd360f3e6f303c766377f02
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              uninstall.xml
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                              • Size 21KB
                                              • SHA256 56a28073c2c82ff5b3ce7cc6c103b2c054f3628fa0d9ac843afb911db42b99da
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              version_manifest.json
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_launchermeta.mojang.com\mc\game\version_manifest.json
                                              • Size 204KB
                                              • SHA256 c25e8d6df9812c36ec41551ae9ac86e6dbb64ff8b4a87a5d2f36e8b390ffd1a5
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              26.3.json
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_piston-meta.mojang.com\v1\packages\4fe1aa1ef8da1cb95c5bad1fb98890ca56dd8ca3\26.3.json
                                              • Size 43KB
                                              • SHA256 9a7b39dae3b9c8d30006b650e357aae220629b7852fa0fc7221db7a8646bd5e4
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              34.json
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_piston-meta.mojang.com\v1\packages\abfaa525f923f807df8b4e4d29c1b5e3a104adbe\34.json
                                              • Size 583KB
                                              • SHA256 0f026e5396e2d709b3e6d8c7b2cc2fba9e6a7f02b53b632ba051edb1cd362377
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              manifest.json
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_piston-meta.mojang.com\v1\packages\b374544c680d965fb5535977d7cb04c6befe1930\manifest.json
                                              • Size 149KB
                                              • SHA256 fcac80eeabd7f68b10136286493f633d043e5804ff4fa1692e654edd129c5853
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              inner_servers-1.3.json
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\configs\inner_servers-1.3.json
                                              • Size 5KB
                                              • SHA256 3cd63fc16117d2a2c9906fd9dbcbb21e0569b6e6a1e20def0272f6316e87b920
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              index_en.html
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\configs_v1\pages\index_en.html
                                              • Size 52KB
                                              • SHA256 b89376f7c2213f92393a28a416cc25a5896a7e852b4d657e00e0e041c578e6f5
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              libraries-1.7.json
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\libraries\org\tlauncher\authlib\libraries-1.7.json
                                              • Size 377KB
                                              • SHA256 0a37d481b94fe7fb9fc60162c22038690c7d67eab09b0b2bfa3445dd01b23710
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              additional_assets-1.1.json
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\versions\new5\additional_assets-1.1.json
                                              • Size 190KB
                                              • SHA256 12ea0578ab812f6e6730ea5b23e7f8bfcbaec59e801b8699abc1e773a3b7476b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              version_manifest.json
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\versions\new5\skin\versions\version_manifest.json
                                              • Size 12KB
                                              • SHA256 e5a04128c61d6c23b527b4914f3cacb711a6691d2eab89813f7f2f5a9d34069f
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              version_manifest.json
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\downloads\versions\new5\version_manifest.json
                                              • Size 49KB
                                              • SHA256 1537f055b6cd0faefdfe6376112bdb0236475b83906981fd6ac692cac36e5951
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              additional_hot_servers-1.0.json
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\lch\additional_hot_servers-1.0.json
                                              • Size 9KB
                                              • SHA256 ba3301eff47472937fcb878c83446061d10215b3d98ab095e87125defb0f597a
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              hot_servers-1.0.json
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_repo.tl.vg\update\lch\servers\hot_servers-1.0.json
                                              • Size 18KB
                                              • SHA256 289d779623cef574393b226432a0a9f19a19586ffa330e7af65fbdc9bb0a74f6
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              java_configuration.json
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\cache\https_rescl.tlauncher.org\b\jvm\java_configuration.json
                                              • Size 13KB
                                              • SHA256 b490908c9bda7f4ed5220145dee8dd1ee9ad92a210080adec3c183b0f0a50a8b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              dependencies.json
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9378\dependencies.json
                                              • Size 25KB
                                              • SHA256 6ac4cc67b7d6c2740882d0969c77bd55f44d7e74047fb7e7723424ea799423cb
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              resources.json
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9378\resources.json
                                              • Size 17KB
                                              • SHA256 03b38fa542128e1c3ff9b057e19e6d1eb5cfefa5df0bcb4aa4dbd16d68162e48
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              appConfig.json
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\appConfig.json
                                              • Size 4KB
                                              • SHA256 3ff78a48297c9369947b007f8776f1762f4e0a7204b598c07f1d5b3437c3e021
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              javaConfig21.json
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\javaConfig21.json
                                              • Size 3KB
                                              • SHA256 4137156413e8ca1b38862aedd342bf6dbf6c2446fd4d86ea6893c0888f260893
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              COPYRIGHT
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\java.logging\COPYRIGHT
                                              • Size 35B
                                              • SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              LICENSE
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\java.logging\LICENSE
                                              • Size 33B
                                              • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              ADDITIONAL_LICENSE_INFO
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\javafx.web\ADDITIONAL_LICENSE_INFO
                                              • Size 51B
                                              • SHA256 0a256a7133bd2146482018ba6204a4ecc75836c139c8792da53536a9b67071d4
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ASSEMBLY_EXCEPTION
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\javafx.web\ASSEMBLY_EXCEPTION
                                              • Size 46B
                                              • SHA256 a4b7ad48df36316ddd7d47fcecc1d7a2c59cbfe22728930220ef63517fd58cb0
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              LICENSE
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\javafx.web\LICENSE
                                              • Size 35B
                                              • SHA256 01a4ebd2a3b2671d913582f1241a176a13e9be98f4e3d5f2f04813e122b88105
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              tlauncher-2.0.properties
                                              • Path C:\Users\Admin\AppData\Roaming\.tlauncher\tlauncher-2.0.properties
                                              • Size 1KB
                                              • SHA256 f42d38360a9550b4e257547160f49888f398b614da46399d5add3cc74257a4ff
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              Opera GX Browser.lnk
                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera GX Browser.lnk
                                              • Size 2KB
                                              • SHA256 290273781f86a9547ac86913aa40126ccf21b1615c08717600c6dee10350e0fd
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dad3ff39dbce30f8.customDestinations-ms
                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\dad3ff39dbce30f8.customDestinations-ms
                                              • Size 23KB
                                              • SHA256 a8104e03de952de0f95c6954bca1954694c26fae6a7784aa25da992c02df7fd1
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              dad3ff39dbce30f8.customDestinations-ms
                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\dad3ff39dbce30f8.customDestinations-ms
                                              • Size 23KB
                                              • SHA256 285df2dad00d6a9b892841f43a4f9434266f6229912392c482a29cc51e23600f
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              4db18d66-6ee9-4b56-84f5-40b3d5ca1da6.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\4db18d66-6ee9-4b56-84f5-40b3d5ca1da6.tmp
                                              • Size 151B
                                              • SHA256 22d38006064ad652208f4f09d3188e46c22553d0ba3e384aed62f0a99adfcaf0
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              settings.dat
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
                                              • Size 40B
                                              • SHA256 923f8dd5f37ad370add3dd49c5f3a124c4949374b98ef11a6ea64be6d9bef6f4
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              2d774af7-b6dc-427f-a3f8-83b090459bfd.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\2d774af7-b6dc-427f-a3f8-83b090459bfd.tmp
                                              • Size 198B
                                              • SHA256 6ee2a994e71cc2154cea5bff9c8eaf620d438c5f80dea264f60c60c170ab28a9
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              5100bcdd-578e-4260-8dc8-3cfce5911073.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\5100bcdd-578e-4260-8dc8-3cfce5911073.tmp
                                              • Size 80KB
                                              • SHA256 e13ad34df1ea10680e42cb4bd26964dd9c90696ed39c477656913bd67974d2f3
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              51403b73-99bc-43ff-a0c2-2fd1ec4d6de9.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\51403b73-99bc-43ff-a0c2-2fd1ec4d6de9.tmp
                                              • Size 23KB
                                              • SHA256 c0323e934801023e36d2ec62171bd1584252f731d15aac29475f11927847f412
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Bookmarks
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Bookmarks
                                              • Size 24KB
                                              • SHA256 43b87946aed5ff875f204b51be619ad6c0bd5b9f1b41f93f0a37c498866a88f6
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              BookmarksExtras46598c53-f5ee-4a92-b837-e54f91a55707.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\BookmarksExtras46598c53-f5ee-4a92-b837-e54f91a55707.tmp
                                              • Size 582KB
                                              • SHA256 8c028cecf86a2184c7136fde8fdad816b0063eb6dfb7354b093cd96769617622
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              9e93fa24-28b9-49a9-a3b8-93ccf5fff85c.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\9e93fa24-28b9-49a9-a3b8-93ccf5fff85c.tmp
                                              • Size 48B
                                              • SHA256 8e05c8c0f5d346f096bfa336c19729851e6a721497929ae87cda592380afdf3a
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              the-real-index
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
                                              • Size 768B
                                              • SHA256 01cea08ac29930c9aeeb6d6142df6d16846f7dbf9f933abcf842dc60ebcfc6a7
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              CURRENT
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extension Rules\CURRENT
                                              • Size 16B
                                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              MANIFEST-000001
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extension Rules\MANIFEST-000001
                                              • Size 41B
                                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              269ec7a5-cc39-4d82-ba57-d5b53436a20d.tmpc62b3fc1-b809-47a4-b9e7-f7f058b71512.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\269ec7a5-cc39-4d82-ba57-d5b53436a20d.tmpc62b3fc1-b809-47a4-b9e7-f7f058b71512.tmp
                                              • Size 27KB
                                              • SHA256 b79b047aa13202f575c92b513e67530ee9a5de4755d8d67c85c2f156c9a4eb39
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              c6a020ca-71d1-4a67-adfe-d13270d7f9c2.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\c6a020ca-71d1-4a67-adfe-d13270d7f9c2.tmp
                                              • Size 27KB
                                              • SHA256 09b4f9a23cfa587b071052ac7cd4803139d3f1775a11b4c552b92472d857f460
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              c6d13d14-3140-4cb1-81f8-137bd6350d1b.tmp63d08c4f-591a-43f4-bccc-101308f6358d.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\c6d13d14-3140-4cb1-81f8-137bd6350d1b.tmp63d08c4f-591a-43f4-bccc-101308f6358d.tmp
                                              • Size 27KB
                                              • SHA256 353f070543d1c43247d565c23d4c0346a8d65d902aa7bae04c6ae5e64bc5cde7
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              db9c72ef-ee7a-453e-9ad7-07a57425b209.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\db9c72ef-ee7a-453e-9ad7-07a57425b209.tmp
                                              • Size 27KB
                                              • SHA256 06fad05c51b9041e1eee874086a13075af058630a44e160890f8ad6cc52cd6d6
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              dddf95de-b929-4299-b2e4-2dde3a618b18.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\dddf95de-b929-4299-b2e4-2dde3a618b18.tmp
                                              • Size 27KB
                                              • SHA256 3e9c6d63eac83dee7079d552aa831a36fcf48ab6b1d6503ebef88797d82e0baf
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              eb9f8a8a-1c90-407f-af30-34980cbb4b1a.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\eb9f8a8a-1c90-407f-af30-34980cbb4b1a.tmp
                                              • Size 27KB
                                              • SHA256 cc914b6c8be70f233d533244b1fe41e32c495b9bb57901a96777f7d19fd75dfa
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              f1da2a29-bc0e-4d34-a9bc-09cedc8bcb77.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\f1da2a29-bc0e-4d34-a9bc-09cedc8bcb77.tmp
                                              • Size 27KB
                                              • SHA256 2f1a860dec73e59307d1a8e1b1ace276076ef77008f468720569bfc8d7ba2512
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Network Persistent State
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Network\Network Persistent State
                                              • Size 2KB
                                              • SHA256 1e2c3c2e7150811f889b4b2aa209d5650e183f904367dde7723ebec209e9c26e
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              eaa5c96f-9f31-482e-a6d1-21aade0050b4.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Network\eaa5c96f-9f31-482e-a6d1-21aade0050b4.tmp
                                              • Size 59B
                                              • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              Opera Custom Icon.ico3fa1cb93-3ce1-41da-ba5a-3d58fd7786b8.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Opera Custom Icon.ico3fa1cb93-3ce1-41da-ba5a-3d58fd7786b8.tmp
                                              • Size 162KB
                                              • SHA256 5903c920e584fc5f1e918bd641bf58fd56e8cb20bb68269892a4984ea7538621
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Preferences
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences
                                              • Size 15KB
                                              • SHA256 4b5f0512220c05ea9c08ae3ba2c740e2a5b9d431ed6a8516998fa27f39dcb03e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Secure Preferences
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Secure Preferences
                                              • Size 97KB
                                              • SHA256 746d339b0db1faa009c4840db9383ca52e42af8e0aceb1d751e5dea1c3064f13
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              cd17c80a-2a3d-41a7-a05c-f0f73803ca0a.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\cd17c80a-2a3d-41a7-a05c-f0f73803ca0a.tmp
                                              • Size 72B
                                              • SHA256 2ebc415cb4d892206c1604f4ceab6ffb0da3e9a016aad8fff359f5861952a921
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              the-real-index
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                              • Size 144B
                                              • SHA256 c4c7fe074dc5a2ba3f5206fc27b2588fef99907956e831cde32237bbe8b265b1
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              f49de61d-5799-436a-baec-bbf221d4c71c.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\f49de61d-5799-436a-baec-bbf221d4c71c.tmp
                                              • Size 381B
                                              • SHA256 71c0d01141df2764e04a73901ed4551428d48e60cc1cdf9b928d3d90237022e1
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 493B
                                              • SHA256 5f5e4ff067da026aa4a388ff78d1e992c48b27104a6a1bfd4f0d4a71cea619a3
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 605B
                                              • SHA256 532f560ba6db78cf37a1235f9dccf7607685bda8241ad68d17c7503240b269a2
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 733B
                                              • SHA256 b37deaa2f4ebb67489e33de164ade6e496fc7bdd249542afb52c94b71addffe9
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 1KB
                                              • SHA256 22c7958f603b929455627b41dea5f1d12e99c42a3aacbf140d33710db1adc8a6
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 8KB
                                              • SHA256 0d62d9260d9ad6caec95617ee7773315dd9f7b38ab743c8f1b087f1bf4e49a56
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 11KB
                                              • SHA256 da6ff9f12add2a1786739dd3231bf342998ebd1860bd62532d57fa2dc0bce70f
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 909B
                                              • SHA256 2726317a89223b50972234f817d5080a73e6d2e12f1edf08ae0b16c50a4d982a
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 1KB
                                              • SHA256 a22397aae1d8da26ee7bcd76d67c2953077d30df35a2ed9c0108a2eb48f6a68f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 1KB
                                              • SHA256 4761afbb09385b5174a4c464d1a16771583e5c90756cd3fa6e7482e1456561d6
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 1KB
                                              • SHA256 e30306694abb7d59728bc0db7624ae57aaa05fd9d4268d47ec7012da5532e6ba
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 2KB
                                              • SHA256 162c6af8f7b2e60ee673f0afec5c5c1cb9c988782bd34af9f6759973e7c8bc01
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 2KB
                                              • SHA256 7597ba99a841c7d7b985653c315e0902c73e12258d2e0ef8e1407d26fd42154e
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 8KB
                                              • SHA256 e01ff45b8e36ed685dab6852cc27d26b4e669cb01a879dd9004b0ac751622e7c
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 8KB
                                              • SHA256 865b43e16b1c2d4cd28448277694700c9eead31ea5811c10046d83242c951a37
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 8KB
                                              • SHA256 eab05b7f952b9f4a123c0fcb883821dce13af114f3db9c042a624d128acdb0a0
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 8KB
                                              • SHA256 6186265d5ce91d9ec3e4390c8978aa3443f1558f139b7f548589bf01c4b95f61
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 8KB
                                              • SHA256 e6a7e77e75276f91aee624c5048c82ed42e6b92a99a1508e70cbd8505233488e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 8KB
                                              • SHA256 0465a21571a73a06ff58ac94dbeb9df7a374bc72cbccdc9587729e7f70cb21e8
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 8KB
                                              • SHA256 3bcafec326ca06838e6611bd076c151cd29fedf2af11890f07dcfa586b128fd3
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 8KB
                                              • SHA256 976e9acc453b89abd1089e9a772012bdffe9074639751275bf96226e626d55e5
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 8KB
                                              • SHA256 af722b3214a19021585e4dc1fe76211dec3a72551436b103bc6c2c586eb0df2f
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 8KB
                                              • SHA256 093208f703052e54d0ec15a2ecd0bd5488e3d847e26ea4a61175a84c932a872b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 8KB
                                              • SHA256 4b606c1fc9838447d562de2fecf72d8db635dc3d55aef55ad7b7864e7d248c0e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 8KB
                                              • SHA256 b530e74fc2f2f72a0f31ed339e106aab7c4007b8ba32ae7fdb0d769fc06394cb
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 9KB
                                              • SHA256 f719d7c7de6397c9be7b3bc4f9091251db391ac53404b759188e2821488bf8b7
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 9KB
                                              • SHA256 99c4c62cecbdadf9dec88acf9b81b74b9bae11b5c72fa88a71401fd575a83479
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 9KB
                                              • SHA256 2ccc49c3febdd574847a2d8e2b1d6875f1480000f93fbc7740448b0180701cf9
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 9KB
                                              • SHA256 3ef4efd4b8e802ecc68051cd498fccd961b31758727aa4d5f2a2623d0d1f1287
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 9KB
                                              • SHA256 94e6341a833964d6f0a03add04f0ace4e5fbda4faee53e9ed5fde32db51a4c9c
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 9KB
                                              • SHA256 41c1941f13c1782c9900c055cdf82c7970a8d9d659d68736d9f3f98d9ba45264
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 9KB
                                              • SHA256 95c1a898a33dfe6313182ca4eef11e38fbb58942e50b7ec78de87600ba1c4ad9
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 9KB
                                              • SHA256 d179a1b2a5c8f9884b6b828e49d87265672a6c680814b0a2d9a1fecf411c55a4
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 9KB
                                              • SHA256 e2cabc5f70124838b9bb78042e122678bc3cc3c43fcc9b86dc8b5bb561e48013
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 9KB
                                              • SHA256 a3e9d42e17772f90239bb631ab943e2d81a87c8e5bab98725f3374c0fbb5cc74
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 9KB
                                              • SHA256 afd7f1bb6c1c91630d6cec1b6c687f2d7e984154b5c04de65f1ff270359fdad0
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 10KB
                                              • SHA256 17e3ed73b5f2c4442535f1e6ebf64cbd297c38c72db6e11421c5cb61b2b9a8c3
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 10KB
                                              • SHA256 50d73f548007081fe2b2348797151e569abaf3f9fecd93df12946a8fcab604f0
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 11KB
                                              • SHA256 a331728c245a9c3d373ed549975931bfe9b733b6225240b35cea17192795d9af
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 11KB
                                              • SHA256 468b6c533fe56bf1317bea8220ea11e3963d5145fec9f3c7b02bffab7d605b04
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 1KB
                                              • SHA256 a712116c997942f4a821e36e2b0b62b2e12b21e9f474c61799fe3fab140db50a
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 1KB
                                              • SHA256 4a593017a6dbbb2483699ef414087950fb07a7312450c323d1723dfc9a71d999
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 2KB
                                              • SHA256 b0dd67aae50b08134b31a7d7c233041dfa63df0eb7a51d7324a4849c223848fa
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 9KB
                                              • SHA256 aa531b868b16f9714e3557add7bf3948cde94c7a02b4dc74a922808edf952840
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 9KB
                                              • SHA256 79c9837461a79002a1bcd135d8e2e565aa2e12be7e87be722c57ba3a9f803b51
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 11KB
                                              • SHA256 0750d90bb9da0882484287f3d850414b0d8faa94eaeb63a57551d65b93bf33d6
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 1KB
                                              • SHA256 7a542fb4bc4b1cac24d8ccfbe2bc442b6444b95c9ff84c856e474b2e1493c95b
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 1KB
                                              • SHA256 ff7f8c8d82fbee40d7aa1fcf47635d91483611c60a105bcaf98d91f3f39bcfbd
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 1KB
                                              • SHA256 37bd236bbb0ef8632e4fb882bc346d1b5853c71d8f38cf353fb524e2597c7e49
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 8KB
                                              • SHA256 079aa1c2f84f0db40e1d341320b9bb364ffe34e15d989ad0db7fb06c5514689f
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 11KB
                                              • SHA256 825895afed0a5bb8ba24df48d9892d812c9620cbbcc58fd4a6d32eaa69922b86
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 11KB
                                              • SHA256 9bfc0765dae736b044837f6cdd37037b7c04774e440aa1110f81daf888dd34c3
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 11KB
                                              • SHA256 6e66ec8bbc1914f2c4e26f104fc6afc4e09016a619a45378caf95cac9e9eb721
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 2KB
                                              • SHA256 9e7431209b8acaee614a7cc5b6c0a5eab7a54b7c662c369b5953bf3a8f010fef
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 2KB
                                              • SHA256 1f997e5abc9d5f586dac89e504fa191ab4a41ee7257aa5526f7ec1de5d605b70
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 2KB
                                              • SHA256 4ef605bb67771d7f60e858a0946d51128e0f106737dcfa08abe7f73f21b4d62f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 2KB
                                              • SHA256 38449abac930b0c12a94ae0f2682c3440d9b359f7c47641fbd74ca88fdf9354a
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 2KB
                                              • SHA256 b8038ba44f4b6be89cae2ad67d2bda6fdeaaee031718866db19629593339b8ef
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 11KB
                                              • SHA256 d8ec59ecfa894f71a0d50992963027fd096a3f9a0730902864fdc1bbcfbcfb87
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 10KB
                                              • SHA256 db59fe8fbf37906c41f26a127102e7879053e3bccb91de8a8984fac5ebc11f6e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 7KB
                                              • SHA256 b2ca7e04650fd4c99426c5acb3a2f5ebcc23184c9e689a5e998a6dd2175fa05d
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 8KB
                                              • SHA256 fb08090b6fd120b7db6f69cc644d2f8c58b53fddaf7c517c9084f7d2b981a34f
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 8KB
                                              • SHA256 80464ffc3acbbbac1c8c40af274cd989215afa42690e16520abc94a6e0c052f3
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 8KB
                                              • SHA256 843cfa047eb4afef19f8f63b1608315b22881316736ab75fa57cb5714d0304d7
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_2cc08737-dd9d-45f3-8403-f413bcf62ac7.raw
                                              • Size 10KB
                                              • SHA256 e1ebafe06cd6033d51098e6f5996ce0c32e14a7f8b51a9e4b8729d312b0ec067
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              c48851e8-020b-445b-9658-9ed4baf01e0f.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\c48851e8-020b-445b-9658-9ed4baf01e0f.tmp
                                              • Size 12KB
                                              • SHA256 c9078a883e5eb133f6f2e3dff510754e0545646b5667bb116edf948c23095e21
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              c63d99f1-c70c-4337-b1c6-d9bffdd9164f.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\c63d99f1-c70c-4337-b1c6-d9bffdd9164f.tmp
                                              • Size 171B
                                              • SHA256 1d918cf6a1a010e42e61bb81ca2e9b4d0f6e8b43305ba9c90a09f43c3111aa75
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 597B
                                              • SHA256 0d82537986152ba16da1a4461fe367a97f143e4276da073fe86cbc4c14319dd7
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 690B
                                              • SHA256 7c6da4449ab3663ecf0cf817804190315dd749cb652da1bf77cabe360e452790
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 779B
                                              • SHA256 aa260edd25a28fd6de2bfbb702242cf68cc1089c40fd5058a8689d9c28b47823
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 1KB
                                              • SHA256 765ece66b56dddf9ea0d7f373125915e91f30229c3711e116e5b829d0997d61e
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 1KB
                                              • SHA256 27936a7d564d24c8f0bbc11c2a8600a7dbc38356927f09e4419a56bf4e59d03b
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 1KB
                                              • SHA256 bb5d46b6aba21c405fecf87b8daef7841afd328f62e9a3257d6358ea6c614493
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 2KB
                                              • SHA256 7db7cf9101c9f14a0c42024b9a7e9f8162b950c77141e1989cf50273e7d98496
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 3KB
                                              • SHA256 b4a2594986be248715874c5b39dec70d22886038fccde41df25ff84d52e8dfda
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 3KB
                                              • SHA256 dfaa31aef196f5ce003c1755869aacd64baeb42e81c66fc4ed10e9a2970ae48f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 3KB
                                              • SHA256 809833b7ec57cb5cfe9ae2fe883b362a5622fd1391b993c04b77a8a2b35e7aef
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 3KB
                                              • SHA256 0526e3e1aaba4d4fc80e388467d1ee267197c6a8300d862608183332d6997537
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 3KB
                                              • SHA256 a36f9fdc661948e3f5725fb74688bc25a3ea39793ee1800b9d8d3eaf15bddc7d
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 3KB
                                              • SHA256 aa5677d7427510045d2fb4c38a3370d27505a2483395d8b8e1487363c3aba503
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 3KB
                                              • SHA256 2dd1cf7ab382529becaa1fd7eb8b83a1f5b406e5e6099de38c48302d7c404052
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 3KB
                                              • SHA256 7ba00f3b64c5693286fca3e586c85adf74fac7967d55e4a3e75b42d719e9ef90
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 412B
                                              • SHA256 64c535ca4ccb2a3b63cd1d17cfe98015f6b13d339437b591bef9bedd22134566
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 1KB
                                              • SHA256 020ee8cc323bdb2a9e5249d3d26561d1dadd733db829ebbfbf9d847ce6a7f87c
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 1KB
                                              • SHA256 b7dac5fd7c32f5ec60f08d54664222b15823a5e8af8a12b6de142a645b53c64d
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 870B
                                              • SHA256 577354006d23797d09bc09fdf332d07448b12a65e20a041488f4f28d17bde8e6
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 1KB
                                              • SHA256 f35e0999b4a875cab519b5c3340b29fa409de41c3a5586f2020f02514eb8317c
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 505B
                                              • SHA256 8b0e088d5f1ba49197d50e6895326f0249c31ee2c1024277cc8b8dc0e11ef4a7
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 999B
                                              • SHA256 8497f46d0d4dfb8015dccbb907d8628167bb9e60200cb0361c41bbe37577e0f2
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 1KB
                                              • SHA256 db02c682e4ed18b8f2d42f0c6af7fb05daf6f5bca3ced5c18c21b4ffe3d08f23
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.0.66192966
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.0.66192966
                                              • Size 1KB
                                              • SHA256 c9dc76f2917e8b3066e46413f044e3aad88950f27771e83f9b09026d268955fb
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.1.1944572723
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.1.1944572723
                                              • Size 309B
                                              • SHA256 b365ba4f928037a32da5f014ac61c44489407ed8d1ed009142f68262cfa0e1cd
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.1.1944572723
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.1.1944572723
                                              • Size 224B
                                              • SHA256 e88eded9310c682c9ce68991dfeb4f8641fad67178f50be2b59c71bb9035fdc2
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.1.1944572723
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.1.1944572723
                                              • Size 1KB
                                              • SHA256 17a7798fd3c20c905f038d627952f8a6a344fc694aff59eefcf662f63df97562
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.1.1944572723
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.1.1944572723
                                              • Size 2KB
                                              • SHA256 2b7cb769d5fccec0f80411db58ed2d571ca5ededeff748970964a5c47b511483
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.1.1944572723
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.1.1944572723
                                              • Size 2KB
                                              • SHA256 193fd338b1b90b697449b80686218f1f99701ebc37ae3048b6363714ef971bed
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.1.1944572723
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.1.1944572723
                                              • Size 2KB
                                              • SHA256 acc05acec9b4b6f4b09bbe5ccddc1039912164d7b5228b87047b734e0856a27a
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.1.1944572723
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.1.1944572723
                                              • Size 200B
                                              • SHA256 1b5a90719280a6aa53a7f5e4d42c1ac5079aadc445b431235e8d878e237a4edc
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.1.1944572723
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.1.1944572723
                                              • Size 224B
                                              • SHA256 1c9348f40ea5d8c5e1a4a0a3a4039319005498d3f095a8516b82b5edb8dd7774
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.1.1944572723
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.1.1944572723
                                              • Size 407B
                                              • SHA256 c9b3062251fe958c68905da1dafc4ea0c297b7f5314bd6e4ab3d05ff70817e7e
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.1.1944572723
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.1.1944572723
                                              • Size 469B
                                              • SHA256 3e5d8a8adddc1439e3c6fa8cce527323b3934e5d529d1e89873c7d35d70acb73
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.1.1944572723
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.1.1944572723
                                              • Size 1KB
                                              • SHA256 6e89a800a7cff7ee0dfaf487c73970b18ad620b4152e4be8363598ed271bcc0f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.1.1944572723
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.1.1944572723
                                              • Size 2KB
                                              • SHA256 0ee13248dfdec35ad9e56653c3556f5e4f1f330c21c4a56986d94cc2cd7a4e59
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.1.1944572723
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.1.1944572723
                                              • Size 2KB
                                              • SHA256 760240803abf878c3b840abad1fc55cfe64f3a7811840b44f7f050efbb0605ac
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.1.1944572723
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.1.1944572723
                                              • Size 2KB
                                              • SHA256 a3708e58912489b46368096ee44b9ccc6901e6b8ff23aba96de3cf8bfa951690
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.1.1944572723
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.1.1944572723
                                              • Size 2KB
                                              • SHA256 7347f3dc26437ab6422e7ceeb31e40ce57332043808a32a56d2c25b6a0e06fc0
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              ssdfp1604.2.441108475
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1604.2.441108475
                                              • Size 242B
                                              • SHA256 d525946184909eaab2571eb8185c5cfdde94075382f68e4b616b113f0a1e0654
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              suggestions_cache.json90226b3c-45f6-482b-b632-e4956b2dd094.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\suggestions_cache.json90226b3c-45f6-482b-b632-e4956b2dd094.tmp
                                              • Size 852KB
                                              • SHA256 119ad1105170cd921f087d8ee6c9c33038e7769f0ba26f25881656120199e0dd
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              data_0
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_0
                                              • Size 8KB
                                              • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                              • MD5 SHA1 SHA512 SSDEEP
                                              Submit Download

                                              data_2
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_2
                                              • Size 8KB
                                              • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                              • MD5 SHA1 SHA512 SSDEEP
                                              Submit Download

                                              data_3
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_3
                                              • Size 8KB
                                              • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                              • MD5 SHA1 SHA512 SSDEEP
                                              Submit Download

                                              Local State
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Local State
                                              • Size 3KB
                                              • SHA256 34ad4369df714d4508b9eb795c68d7c58e4617bef7817987d21290dfa5076e33
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              VariationsSeedV2
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\VariationsSeedV2
                                              • Size 11B
                                              • SHA256 b4cc4174735c28360b9081be3c3d0552d8a4b3cdb54431ac00ed0d622bab6296
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              VariationsSeedV2
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\VariationsSeedV2
                                              • Size 19B
                                              • SHA256 1560b22b2264f7cb6b7f6910164813f76c5e8a06fb1acf85b375e687ee49c1ad
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              assistant_prefs.json
                                              • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\assistant_prefs.json
                                              • Size 151B
                                              • SHA256 d338269ce6d03f1a90a01a3c7a8eee8155b5324926135389fa0215a68fa55bdb
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              logo.png
                                              • Path C:\Windows\Temp\{0176D611-EA3B-4C23-9619-B7A4315CF0F9}\.ba\logo.png
                                              • Size 1KB
                                              • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              wixstdba.dll
                                              • Path C:\Windows\Temp\{0176D611-EA3B-4C23-9619-B7A4315CF0F9}\.ba\wixstdba.dll
                                              • Size 215KB
                                              • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                              • Path C:\Windows\Temp\{0176D611-EA3B-4C23-9619-B7A4315CF0F9}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                              • Size 5.4MB
                                              • SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              cab5046A8AB272BF37297BB7928664C9503
                                              • Path C:\Windows\Temp\{0176D611-EA3B-4C23-9619-B7A4315CF0F9}\cab5046A8AB272BF37297BB7928664C9503
                                              • Size 964KB
                                              • SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              vcRuntimeAdditional_x64
                                              • Path C:\Windows\Temp\{0176D611-EA3B-4C23-9619-B7A4315CF0F9}\vcRuntimeAdditional_x64
                                              • Size 208KB
                                              • SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              vcRuntimeMinimum_x64
                                              • Path C:\Windows\Temp\{0176D611-EA3B-4C23-9619-B7A4315CF0F9}\vcRuntimeMinimum_x64
                                              • Size 208KB
                                              • SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              license.rtf
                                              • Path C:\Windows\Temp\{469BD474-8DDC-4929-962A-1AB2BBB08E8D}\.ba\license.rtf
                                              • Size 9KB
                                              • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              thm.wxl
                                              • Path C:\Windows\Temp\{469BD474-8DDC-4929-962A-1AB2BBB08E8D}\.ba\thm.wxl
                                              • Size 2KB
                                              • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              thm.xml
                                              • Path C:\Windows\Temp\{469BD474-8DDC-4929-962A-1AB2BBB08E8D}\.ba\thm.xml
                                              • Size 8KB
                                              • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              wixstdba.dll
                                              • Path C:\Windows\Temp\{469BD474-8DDC-4929-962A-1AB2BBB08E8D}\.ba\wixstdba.dll
                                              • Size 191KB
                                              • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              vc_redist.x64.exe
                                              • Path C:\Windows\Temp\{4EAA049E-44C3-4B3B-B8E0-7834E8489B22}\.cr\vc_redist.x64.exe
                                              • Size 670KB
                                              • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              memory/464-1025-0x0000000000790000-0x0000000000807000-memory.dmp
                                              Download

                                              memory/536-761-0x0000000000CE0000-0x00000000012E1000-memory.dmp
                                              Download

                                              memory/536-2315-0x0000000000CE0000-0x00000000012E1000-memory.dmp
                                              Download

                                              memory/536-567-0x0000000000CE0000-0x00000000012E1000-memory.dmp
                                              Download

                                              memory/536-578-0x0000000000CE0000-0x00000000012E1000-memory.dmp
                                              Download

                                              memory/536-1807-0x0000000000CE0000-0x00000000012E1000-memory.dmp
                                              Download

                                              memory/536-14-0x0000000000CE0000-0x00000000012E1000-memory.dmp
                                              Download

                                              memory/536-3915-0x0000000000CE0000-0x00000000012E1000-memory.dmp
                                              Download

                                              memory/536-908-0x0000000000CE0000-0x00000000012E1000-memory.dmp
                                              Download

                                              memory/536-599-0x0000000000CE0000-0x00000000012E1000-memory.dmp
                                              Download

                                              memory/536-3891-0x0000000000CE0000-0x00000000012E1000-memory.dmp
                                              Download

                                              memory/2516-2408-0x00000000008B0000-0x0000000000EB1000-memory.dmp
                                              Download

                                              memory/2516-637-0x00000000008B0000-0x0000000000EB1000-memory.dmp
                                              Download

                                              memory/2516-910-0x00000000008B0000-0x0000000000EB1000-memory.dmp
                                              Download

                                              memory/2516-763-0x00000000008B0000-0x0000000000EB1000-memory.dmp
                                              Download

                                              memory/2516-1809-0x00000000008B0000-0x0000000000EB1000-memory.dmp
                                              Download

                                              memory/2516-3100-0x00000000008B0000-0x0000000000EB1000-memory.dmp
                                              Download

                                              memory/3436-1023-0x0000000000790000-0x0000000000807000-memory.dmp
                                              Download

                                              memory/4800-1026-0x0000000000790000-0x0000000000807000-memory.dmp
                                              Download

                                              memory/5008-1808-0x000001D995480000-0x000001D995F42000-memory.dmp
                                              Download

                                              memory/5340-2058-0x00007FFEC8B80000-0x00007FFEC8B81000-memory.dmp
                                              Download

                                              memory/5340-2059-0x00007FFEC8360000-0x00007FFEC8361000-memory.dmp
                                              Download

                                              memory/7460-5448-0x000001E79AA60000-0x000001E79AA61000-memory.dmp
                                              Download

                                              memory/7460-5450-0x000001E79AA60000-0x000001E79AA61000-memory.dmp
                                              Download

                                              memory/7460-5441-0x000001E79AA60000-0x000001E79AA61000-memory.dmp
                                              Download

                                              memory/7460-5443-0x000001E79AA60000-0x000001E79AA61000-memory.dmp
                                              Download

                                              memory/7460-5442-0x000001E79AA60000-0x000001E79AA61000-memory.dmp
                                              Download

                                              memory/7460-5447-0x000001E79AA60000-0x000001E79AA61000-memory.dmp
                                              Download

                                              memory/7460-5453-0x000001E79AA60000-0x000001E79AA61000-memory.dmp
                                              Download

                                              memory/7460-5452-0x000001E79AA60000-0x000001E79AA61000-memory.dmp
                                              Download

                                              memory/7460-5451-0x000001E79AA60000-0x000001E79AA61000-memory.dmp
                                              Download

                                              memory/7460-5449-0x000001E79AA60000-0x000001E79AA61000-memory.dmp
                                              Download

                                              memory/8036-3926-0x00007FF671510000-0x00007FF6759DD000-memory.dmp
                                              Download

                                              memory/8044-5583-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5582-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5735-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5712-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5692-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5659-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5651-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5625-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5609-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5607-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5603-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5580-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-6064-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5584-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5586-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5604-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5596-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5769-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5576-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5579-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5581-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5578-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5563-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5562-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5561-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5560-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5836-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5872-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5892-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5906-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5941-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5968-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-5999-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-6041-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-6092-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download

                                              memory/8044-6080-0x0000015F1CC80000-0x0000015F1DC80000-memory.dmp
                                              Download