Overview

overview

8

Static

static

3

DS for Win...40.exe

windows10-2004-x64

7

DS for Win...40.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    900s
  • max time network
    896s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/10/2026, 03:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DS for Windows_20740.exe
  • Size 757KB
  • Sample261030-eccweaws6n
  • SHA256 92ad1b3bb31cf3eb7c4a4fee45342aa96ee11f4896e03d3ad77029ee92052822
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 5 IoCs
  • Manipulates Digital Signatures 1 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes a Windows system DLL name to a user directory 2 TTPs 2 IoCs

    A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

    defense_evasion
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 7 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 34 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 44 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 55 IoCs
  • Modifies registry class 56 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 40 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
    1⤵
    • Loads dropped DLL
    PID:1652
    • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe7FAE56220944838BCDB933E86AD23A432FE91C0ADA84DF94778C72EE141B2B1F
      2⤵
      • Enumerates system info in registry
      PID:9064
      • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x294,0x298,0x29c,0x234,0x2a0,0x7ff7b4414df8,0x7ff7b4414e08,0x7ff7b4414e18
        3⤵
          PID:8528
    • C:\Users\Admin\AppData\Local\Temp\DS for Windows_20740.exe
      "C:\Users\Admin\AppData\Local\Temp\DS for Windows_20740.exe"
      1⤵
      • Downloads MZ/PE file
      • Reads the TCP/IP host and domain name from the registry
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3304
      • C:\Users\Admin\AppData\Local\OperaGX_20740.exe
        C:\Users\Admin\AppData\Local\OperaGX_20740.exe --silent --allusers=0
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1288
        • C:\Users\Admin\AppData\Local\Temp\7zS8059A469\installer.exe
          C:\Users\Admin\AppData\Local\Temp\7zS8059A469\installer.exe --silent --allusers=0 --server-tracking-blob=ODA3YjNmMTk3ZGFkZjdiZmM2OTJhZDQ5MGUwZTliMjc4NjI5NjY0Nzg3ZGQxZjdmYjhmMzFjYWFiNGRmYTllZDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPWM4ODMwM2NhN2EzZTQ4NWRhZWE1OWU1YmJiMjVmZTZhIiwidGltZXN0YW1wIjoiMTc5MzMzMjA4NS42MTk5IiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fR0JfUEI1Xzk0MTZfMzU3NSIsImlkIjoiYzg4MzAzY2E3YTNlNDg1ZGFlYTU5ZTViYmIyNWZlNmEiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJkMDQ3MGRmMC0zYjNmLTQ5ODYtYjkxYy04YzdjM2Q5OGQ0YmMifQ==
          3⤵
          • Downloads MZ/PE file
          • Executes dropped EXE
          • Enumerates connected drives
          • Reads the TCP/IP host and domain name from the registry
          • Enumerates system info in registry
          • Suspicious use of WriteProcessMemory
          PID:4124
          • C:\Users\Admin\AppData\Local\Temp\7zS8059A469\installer.exe
            C:\Users\Admin\AppData\Local\Temp\7zS8059A469\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.65 --initial-client-data=0x2a8,0x2ac,0x2b0,0x288,0x2b4,0x7ff7539e02d8,0x7ff7539e02e8,0x7ff7539e02f8
            4⤵
            • Executes dropped EXE
            PID:1792
          • C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\installer.exe
            "C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\installer.exe" --version
            4⤵
            • Executes dropped EXE
            PID:2464
          • C:\Users\Admin\AppData\Local\Temp\7zS8059A469\installer.exe
            "C:\Users\Admin\AppData\Local\Temp\7zS8059A469\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=4124 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_20261030034808" --session-guid=ab9e2896-174d-4753-8e5c-98aa448a481c --server-tracking-blob=YzNhZDM3NmU2ZDMxN2UyNWMzMTQ5ZGFhYjgxMjk5Y2MzZGFhZGZlY2E0ZTM0N2E0YjFiM2IxYTI0NTBlMGIyZDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPWM4ODMwM2NhN2EzZTQ4NWRhZWE1OWU1YmJiMjVmZTZhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzkzMzMyMDg1LjYxOTkiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA3LjA7IFdpbmRvd3MgTlQgNi4yOyBXaW42NDsgeDY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfOTQxNl8zNTc1IiwiaWQiOiJjODgzMDNjYTdhM2U0ODVkYWVhNTllNWJiYjI1ZmU2YSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImQwNDcwZGYwLTNiM2YtNDk4Ni1iOTFjLThjN2MzZDk4ZDRiYyJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=E407000000000000
            4⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Enumerates system info in registry
            • Suspicious use of WriteProcessMemory
            PID:1472
            • C:\Users\Admin\AppData\Local\Temp\7zS8059A469\installer.exe
              C:\Users\Admin\AppData\Local\Temp\7zS8059A469\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.65 --initial-client-data=0x2b4,0x2b8,0x2bc,0x288,0x2c0,0x7ff7539e02d8,0x7ff7539e02e8,0x7ff7539e02f8
              5⤵
              • Executes dropped EXE
              PID:264
            • C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\installer.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\installer.exe" --backend --initial-pid=4124 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081" --session-guid=ab9e2896-174d-4753-8e5c-98aa448a481c --server-tracking-blob=YzNhZDM3NmU2ZDMxN2UyNWMzMTQ5ZGFhYjgxMjk5Y2MzZGFhZGZlY2E0ZTM0N2E0YjFiM2IxYTI0NTBlMGIyZDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPWM4ODMwM2NhN2EzZTQ4NWRhZWE1OWU1YmJiMjVmZTZhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzkzMzMyMDg1LjYxOTkiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA3LjA7IFdpbmRvd3MgTlQgNi4yOyBXaW42NDsgeDY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfOTQxNl8zNTc1IiwiaWQiOiJjODgzMDNjYTdhM2U0ODVkYWVhNTllNWJiYjI1ZmU2YSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImQwNDcwZGYwLTNiM2YtNDk4Ni1iOTFjLThjN2MzZDk4ZDRiYyJ9 --silent --desktopshortcut=1 --install-subfolder=138.0.6044.45
              5⤵
              • Executes dropped EXE
              • Enumerates connected drives
              • Enumerates system info in registry
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:4300
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\installer.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x2ac,0x2b0,0x2b4,0x234,0x2b8,0x7ff6946402d8,0x7ff6946402e8,0x7ff6946402f8
                6⤵
                • Executes dropped EXE
                PID:4196
              • C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --copyonly=0 --allusers=0
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Writes a Windows system DLL name to a user directory
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Suspicious use of WriteProcessMemory
                PID:2440
                • C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.65 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x106b558,0x106b564,0x106b570
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:1276
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --run-assistant --allusers=0
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Enumerates system info in registry
                  • Suspicious use of WriteProcessMemory
                  PID:5652
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.65 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x10db558,0x10db564,0x10db570
                    8⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:1224
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --installer-run
                    8⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Reads the TCP/IP host and domain name from the registry
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of WriteProcessMemory
                    PID:2828
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                      9⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:2024
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7ffd31adb420,0x7ffd31adb430,0x7ffd31adb440
                        10⤵
                        • Executes dropped EXE
                        PID:6392
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                      9⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of WriteProcessMemory
                      PID:6580
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7ffd31adb420,0x7ffd31adb430,0x7ffd31adb440
                        10⤵
                        • Executes dropped EXE
                        PID:6676
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.65 --initial-client-data=0x294,0x298,0x29c,0x26c,0x2a0,0xa08f60,0xa08f6c,0xa08f78
                      9⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:7604
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                        10⤵
                        • Executes dropped EXE
                        • Enumerates system info in registry
                        PID:7808
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7ffd31adb420,0x7ffd31adb430,0x7ffd31adb440
                          11⤵
                          • Executes dropped EXE
                          PID:7844
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                        10⤵
                        • Executes dropped EXE
                        • Enumerates system info in registry
                        PID:7964
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7ffd31adb420,0x7ffd31adb430,0x7ffd31adb440
                          11⤵
                          • Executes dropped EXE
                          PID:8012
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                        10⤵
                        • Executes dropped EXE
                        • Enumerates system info in registry
                        PID:8116
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x164,0x168,0x16c,0x160,0x170,0x7ffd31adb420,0x7ffd31adb430,0x7ffd31adb440
                          11⤵
                          • Executes dropped EXE
                          PID:8140
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                • Reads the TCP/IP host and domain name from the registry
                • Checks processor information in registry
                • Enumerates system info in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:2468
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x15c,0x160,0x164,0x158,0x168,0x7ffd31adb420,0x7ffd31adb430,0x7ffd31adb440
                  7⤵
                  • Executes dropped EXE
                  PID:6292
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=1828,i,6936312672351782860,13415682776244220487,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2280 /prefetch:11
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Reads the TCP/IP host and domain name from the registry
                  • System Time Discovery
                  • Enumerates system info in registry
                  PID:6916
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=gpu-process --gpu-recent-crash-count=0 --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1568,i,16791294034275558242,2496566064499706451,262144 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2148 /prefetch:2
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:6924
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=2480,i,10205875822562587220,11906706144553358529,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2488 /prefetch:13
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Enumerates system info in registry
                  PID:6976
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3196,i,1487871540294803628,11588050380162747383,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3344 /prefetch:14
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Enumerates system info in registry
                  PID:7088
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3268,i,2104683134841857410,9107640988566023231,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3428 /prefetch:14
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Enumerates system info in registry
                  PID:7096
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3280,i,9821812287227940055,6443435983137149907,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3448 /prefetch:14
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Enumerates system info in registry
                  PID:7104
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3188,i,15410632292008771716,1097427597521258233,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3368 /prefetch:14
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Enumerates system info in registry
                  PID:7112
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3232,i,11484781436104602344,10913570046110548699,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3388 /prefetch:14
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Enumerates system info in registry
                  PID:7120
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3252,i,16903800731645442323,15565560637280588227,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3408 /prefetch:14
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Enumerates system info in registry
                  PID:7128
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 OPR/138.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3492,i,3875603524432225667,1858217504231267194,1572864 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3372 /prefetch:1
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Enumerates system info in registry
                  PID:7144
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_gx_splash.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_gx_splash.exe" --instance-name=61C8973803226C4D4008DEBC18682105EDAB1556896BB924D0EEB1B6C96AB147
                  7⤵
                  • Executes dropped EXE
                  PID:7976
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 OPR/138.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4780,i,17780400301131825956,5230936020549896346,1572864 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4800 /prefetch:1
                  7⤵
                  • Enumerates system info in registry
                  PID:8072
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 OPR/138.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5044,i,7516625131339555210,13858942190705270244,1572864 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5076 /prefetch:9
                  7⤵
                  • Enumerates system info in registry
                  PID:7996
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 OPR/138.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5216,i,17031750523077780385,16959357213265351246,1572864 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5260 /prefetch:1
                  7⤵
                    PID:8080
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --asus-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=5304,i,11116728787187690408,17035683906112059370,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5320 /prefetch:14
                    7⤵
                      PID:7140
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 OPR/138.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5232,i,8065722970286682017,7677263968676835292,1572864 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5280 /prefetch:1
                      7⤵
                      • Enumerates system info in registry
                      PID:8136
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --corsair-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=5300,i,8155854851729728955,15768660386885019725,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5292 /prefetch:14
                      7⤵
                      • Enumerates system info in registry
                      PID:6704
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --logitech-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=5308,i,11271893509772403513,15348825442256750849,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5452 /prefetch:14
                      7⤵
                        PID:8124
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --razer-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=5324,i,16526913544678299479,4195889508984506953,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5420 /prefetch:14
                        7⤵
                        • Enumerates system info in registry
                        PID:7900
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 OPR/138.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6100,i,3844924834789628037,18034101350105541700,1572864 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6472 /prefetch:9
                        7⤵
                          PID:4856
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 OPR/138.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7008,i,761930389947687491,4202359674978343804,1572864 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=3480 /prefetch:9
                          7⤵
                          • Enumerates system info in registry
                          PID:4988
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 OPR/138.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6884,i,17167585122542851323,5959934991836270826,1572864 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6860 /prefetch:1
                          7⤵
                            PID:9032
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=6944,i,7749287670237335998,2528850518118391135,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7012 /prefetch:12
                            7⤵
                            • Enumerates system info in registry
                            PID:9168
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=6896,i,3028985236061794400,2439613798907932228,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7568 /prefetch:14
                            7⤵
                              PID:8260
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=5404,i,1575053468226932414,2553659024113629598,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7708 /prefetch:14
                              7⤵
                                PID:8292
                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7848,i,16391202168417662041,2598126731583140199,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7712 /prefetch:14
                                7⤵
                                • Enumerates system info in registry
                                PID:8396
                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=8032,i,13722283626329224202,2628466745908267097,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=6844 /prefetch:14
                                7⤵
                                  PID:2296
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=8012,i,307817453601282457,3428965802901763148,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=8168 /prefetch:14
                                  7⤵
                                  • Enumerates system info in registry
                                  PID:6268
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=8028,i,8698987502561016236,8570199436292892412,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=8180 /prefetch:14
                                  7⤵
                                  • Enumerates system info in registry
                                  PID:6688
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=8160,i,7673137155834531543,14006075662550429062,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8200 /prefetch:14
                                  7⤵
                                    PID:6616
                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --pipeid=oauc_pipeF347B60CA73F3F3DA84B31019F4EB851ECFC332513021FC062CC0CA8D8440B54
                                    7⤵
                                    • Enumerates system info in registry
                                    PID:9048
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff7b4414df8,0x7ff7b4414e08,0x7ff7b4414e18
                                      8⤵
                                        PID:2300
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 OPR/138.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=9076,i,2723860910875185369,18060911354666403214,1572864 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=9116 /prefetch:9
                                      7⤵
                                      • Enumerates system info in registry
                                      PID:9096
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=9040,i,7526323702436529927,7712608933233276011,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=9060 /prefetch:14
                                      7⤵
                                      • Enumerates system info in registry
                                      PID:9140
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=9008,i,16605664403939145156,5200967196002108618,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=9244 /prefetch:14
                                      7⤵
                                        PID:9160
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=9012,i,16749990484000385145,3847208887358182853,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=9264 /prefetch:14
                                        7⤵
                                        • Enumerates system info in registry
                                        PID:9152
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=9232,i,4727308351942111161,14648284842064590746,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=9272 /prefetch:14
                                        7⤵
                                        • Enumerates system info in registry
                                        PID:8952
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=9292,i,3127278036130980242,2205677891536515709,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9364 /prefetch:14
                                        7⤵
                                        • Enumerates system info in registry
                                        PID:9196
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=9304,i,15594330670499328058,16741969698377122718,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9388 /prefetch:14
                                        7⤵
                                        • Enumerates system info in registry
                                        PID:7584
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=9948,i,9244216275101380106,2257485164565429391,524288 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=10088 /prefetch:14
                                        7⤵
                                        • Enumerates system info in registry
                                        PID:7984
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 OPR/138.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gcm-store-self-repair=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=10340,i,11747706998565149820,8138081157076608885,1572864 --field-trial-handle=2152,i,5725788065757683642,7507657881066817007,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,GcmStoreSelfRepair,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2156,i,15550980948906005603,9645426659228220645,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=10272 /prefetch:1
                                        7⤵
                                          PID:7648
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --edition=std-2 --host=https://autoupdate.opera.com/ --installationdatadir="C:\Users\Admin\AppData\Local\Programs\Opera GX" --installdir="C:\Users\Admin\AppData\Local\Programs\Opera GX" --lang=en-US --pipeid --producttype --requesttype=shutdown --version=138.0.6044.45 --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --firstrunver=138.0.6044.45 --firstrunts=1793332151 --consent-info=eyJzdGF0aXN0aWNzX2NvbGxlY3Rpb25fZW5hYmxlZCI6dHJ1ZSwidXNlcl9leHBlcmllbmNlX21ldHJpY3NfcmVwb3J0aW5nX2VuYWJsZWQiOnRydWV9
                                          7⤵
                                          • Reads the TCP/IP host and domain name from the registry
                                          • Enumerates system info in registry
                                          PID:9468
                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x29c,0x2a0,0x2a4,0x274,0x2a8,0x7ff7b4414df8,0x7ff7b4414e08,0x7ff7b4414e18
                                            8⤵
                                              PID:10144
                                    • C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\assistant\Opera_GX_assistant_138.0.6044.65_Setup.exe_sfx.exe
                                      "C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\assistant\Opera_GX_assistant_138.0.6044.65_Setup.exe_sfx.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      • Writes a Windows system DLL name to a user directory
                                      • System Location Discovery: System Language Discovery
                                      PID:240
                                    • C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\assistant\assistant_installer.exe
                                      "C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\assistant\assistant_installer.exe" --version
                                      4⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:2000
                                      • C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\assistant\assistant_installer.exe
                                        "C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.65 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x106b558,0x106b564,0x106b570
                                        5⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        PID:2912
                                • C:\Users\Admin\AppData\Local\Temp\GLY5B84.tmp.exe
                                  "C:\Users\Admin\AppData\Local\Temp\GLY5B84.tmp.exe" --silent --silent --launch --channel IU
                                  2⤵
                                  • Executes dropped EXE
                                  • Reads the TCP/IP host and domain name from the registry
                                  • Modifies system certificate store
                                  • Suspicious use of WriteProcessMemory
                                  PID:4768
                                  • C:\Program Files\Glory\Glory.exe
                                    "C:\Program Files\Glory\Glory.exe" install IU
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:3004
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\Glory_CreateStartupTask.ps1"
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4628
                                  • C:\Program Files\Glory\Glory.exe
                                    "C:\Program Files\Glory\Glory.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2352
                                    • C:\Program Files\Glory\Glory.exe
                                      "C:\Program Files\Glory\Glory.exe" --sciter-ui
                                      4⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of SetWindowsHookEx
                                      PID:3600
                                • C:\Users\Admin\AppData\Local\AIChat_20740.exe
                                  C:\Users\Admin\AppData\Local\AIChat_20740.exe /S
                                  2⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Reads the TCP/IP host and domain name from the registry
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1608
                                  • C:\Users\Admin\AppData\Local\aichat\aichat.exe
                                    "C:\Users\Admin\AppData\Local\aichat\aichat.exe" --hidden
                                    3⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Checks whether UAC is enabled
                                    • Reads the TCP/IP host and domain name from the registry
                                    • Modifies system certificate store
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of WriteProcessMemory
                                    PID:3052
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3052.2904.7975047279659414066 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                      4⤵
                                      • Enumerates system info in registry
                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                      • Suspicious use of WriteProcessMemory
                                      PID:3548
                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView /prefetch:4 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd5ec85fd8,0x7ffd5ec85fe4,0x7ffd5ec85ff0
                                        5⤵
                                          PID:5860
                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,12930447502325742054,2060279534257850345,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                          5⤵
                                            PID:3736
                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2104 --field-trial-handle=1756,i,12930447502325742054,2060279534257850345,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                            5⤵
                                              PID:5644
                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2280 --field-trial-handle=1756,i,12930447502325742054,2060279534257850345,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                              5⤵
                                                PID:1776
                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3540 --field-trial-handle=1756,i,12930447502325742054,2060279534257850345,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6 /prefetch:1
                                                5⤵
                                                  PID:2572
                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4572 --field-trial-handle=1756,i,12930447502325742054,2060279534257850345,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                  5⤵
                                                    PID:8492
                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4652 --field-trial-handle=1756,i,12930447502325742054,2060279534257850345,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                    5⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:7900
                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=1756,i,12930447502325742054,2060279534257850345,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                    5⤵
                                                      PID:9604
                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4676 --field-trial-handle=1756,i,12930447502325742054,2060279534257850345,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                      5⤵
                                                        PID:2480
                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4812 --field-trial-handle=1756,i,12930447502325742054,2060279534257850345,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                        5⤵
                                                          PID:6980
                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4784 --field-trial-handle=1756,i,12930447502325742054,2060279534257850345,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                          5⤵
                                                            PID:636
                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4756 --field-trial-handle=1756,i,12930447502325742054,2060279534257850345,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                            5⤵
                                                              PID:4280
                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=1756,i,12930447502325742054,2060279534257850345,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                              5⤵
                                                                PID:1948
                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=1756,i,12930447502325742054,2060279534257850345,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                                5⤵
                                                                  PID:3496
                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4700 --field-trial-handle=1756,i,12930447502325742054,2060279534257850345,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                                  5⤵
                                                                    PID:2288
                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4552 --field-trial-handle=1756,i,12930447502325742054,2060279534257850345,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                                    5⤵
                                                                      PID:4940
                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4784 --field-trial-handle=1756,i,12930447502325742054,2060279534257850345,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                                      5⤵
                                                                        PID:6304
                                                                • C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnion
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3316
                                                                  • C:\Program Files (x86)\PremierOpinion\pmropn.exe
                                                                    C:\Program Files (x86)\PremierOpinion\pmropn.exe -install -uninst:PremierOpinion -t:InstallUnion -bid:ZIjWdISF4a2XET96VSPOPN -o:0
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Modifies trusted root certificate store through registry
                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies system certificate store
                                                                    PID:2044
                                                              • C:\Program Files\Glory\Glory.exe
                                                                "C:\Program Files\Glory\Glory.exe"
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Reads the TCP/IP host and domain name from the registry
                                                                • Modifies data under HKEY_USERS
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5288
                                                                • C:\Program Files\Glory\Glory.exe
                                                                  "C:\Program Files\Glory\Glory.exe" --minimized
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  • Suspicious use of SendNotifyMessage
                                                                  PID:4688
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                1⤵
                                                                  PID:200
                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --autostart
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Enumerates system info in registry
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  • Suspicious use of SendNotifyMessage
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4864
                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Enumerates system info in registry
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1668
                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe
                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7ffd31adb420,0x7ffd31adb430,0x7ffd31adb440
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      PID:3292
                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Enumerates system info in registry
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4408
                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe
                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7ffd31adb420,0x7ffd31adb430,0x7ffd31adb440
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      PID:4152
                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.65 --initial-client-data=0x294,0x298,0x29c,0x258,0x2a0,0xa08f60,0xa08f6c,0xa08f78
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4448
                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Enumerates system info in registry
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1828
                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe
                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7ffd31adb420,0x7ffd31adb430,0x7ffd31adb440
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:1816
                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Enumerates system info in registry
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4528
                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe
                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7ffd31adb420,0x7ffd31adb430,0x7ffd31adb440
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:236
                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:6172
                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe
                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7ffd31adb420,0x7ffd31adb430,0x7ffd31adb440
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:6212
                                                                • C:\Windows\System32\rundll32.exe
                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                  1⤵
                                                                    PID:1828
                                                                  • C:\Program Files (x86)\PremierOpinion\pmservice.exe
                                                                    "C:\Program Files (x86)\PremierOpinion\pmservice.exe" /service
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Modifies trusted root certificate store through registry
                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies data under HKEY_USERS
                                                                    • Modifies system certificate store
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:6152
                                                                    • C:\Windows\system32\rundll32.exe
                                                                      C:\Windows\system32\rundll32.exe C:\Windows\system32\pmls64.dll,UpdateProcess 1652
                                                                      2⤵
                                                                      • Loads dropped DLL
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:6200
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg.exe EXPORT "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{eeb86aef-4a5d-4b75-9d74-f16d438fc286}" C:\PROGRA~2\PREMIE~1\RData.reg /y
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:6596
                                                                    • \??\c:\program files (x86)\premieropinion\pmropn.exe
                                                                      "c:\program files (x86)\premieropinion\pmropn.exe" -boot
                                                                      2⤵
                                                                      • Manipulates Digital Signatures
                                                                      • Drops file in System32 directory
                                                                      • Drops file in Program Files directory
                                                                      • Drops file in Windows directory
                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Checks SCSI registry key(s)
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SendNotifyMessage
                                                                      PID:6584
                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                        CheckNetIsolation.exe LoopbackExempt -s
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:9264
                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                        CheckNetIsolation.exe LoopbackExempt -s
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:10036
                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell Get-AppxPackage
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:7840
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      /C C:\PROGRA~2\PREMIE~1\pmropn32.exe 6584
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:8268
                                                                      • C:\PROGRA~2\PREMIE~1\pmropn32.exe
                                                                        C:\PROGRA~2\PREMIE~1\pmropn32.exe 6584
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:844
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      /C C:\PROGRA~2\PREMIE~1\pmropn64.exe 6584
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:6852
                                                                      • C:\PROGRA~2\PREMIE~1\pmropn64.exe
                                                                        C:\PROGRA~2\PREMIE~1\pmropn64.exe 6584
                                                                        3⤵
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:6716
                                                                    • \??\c:\program files (x86)\premieropinion\pmropn.exe
                                                                      "c:\program files (x86)\premieropinion\pmropn.exe" -updateapps
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:7512
                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.aad.brokerplugin_cw5n1h2txyewy
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:8880
                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ecapp_8wekyb3d8bbwe
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:9476
                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedge.stable_8wekyb3d8bbwe
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:9604
                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.sechealthui_8wekyb3d8bbwe
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:9484
                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ui.xaml.2.8_8wekyb3d8bbwe
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:9552
                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.vclibs.140.00_8wekyb3d8bbwe
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:9744
                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.win32webviewhost_cw5n1h2txyewy
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:9700
                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.narratorquickstart_8wekyb3d8bbwe
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:9832
                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.shellexperiencehost_cw5n1h2txyewy
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:9812
                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:9976
                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoftwindows.client.cbs_cw5n1h2txyewy
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:9912
                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=windows.immersivecontrolpanel_cw5n1h2txyewy
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:10064
                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=windows_ie_ac_001
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:10008
                                                                    • \??\c:\program files (x86)\premieropinion\pmropn.exe
                                                                      "c:\program files (x86)\premieropinion\pmropn.exe" -installmenu:PremierOpinion -v:NONE
                                                                      2⤵
                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies data under HKEY_USERS
                                                                      PID:9040
                                                                  • C:\Windows\system32\wbem\unsecapp.exe
                                                                    C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                    1⤵
                                                                      PID:6888
                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --autostart
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      • Enumerates system info in registry
                                                                      PID:6276
                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe
                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\138.0.6044.45\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7ffd31adb420,0x7ffd31adb430,0x7ffd31adb440
                                                                        2⤵
                                                                          PID:6876
                                                                      • C:\Windows\system32\wbem\unsecapp.exe
                                                                        C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                        1⤵
                                                                          PID:8836
                                                                        • C:\Windows\System32\SecurityHealthHost.exe
                                                                          \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                                                          1⤵
                                                                            PID:8392

                                                                          Network

                                                                                MITRE ATT&CK Enterprise v16

                                                                                Reconnaissance

                                                                                Resource Development

                                                                                Initial Access

                                                                                Execution

                                                                                Command and Scripting Interpreter

                                                                                1
                                                                                T1059

                                                                                PowerShell

                                                                                1
                                                                                T1059.001

                                                                                Persistence

                                                                                Boot or Logon Autostart Execution

                                                                                1
                                                                                T1547

                                                                                Registry Run Keys / Startup Folder

                                                                                1
                                                                                T1547.001

                                                                                Event Triggered Execution

                                                                                1
                                                                                T1546

                                                                                Component Object Model Hijacking

                                                                                1
                                                                                T1546.015

                                                                                Hijack Execution Flow

                                                                                1
                                                                                T1574

                                                                                DLL Search Order Hijacking

                                                                                1
                                                                                T1574.001

                                                                                Privilege Escalation

                                                                                Boot or Logon Autostart Execution

                                                                                1
                                                                                T1547

                                                                                Registry Run Keys / Startup Folder

                                                                                1
                                                                                T1547.001

                                                                                Event Triggered Execution

                                                                                1
                                                                                T1546

                                                                                Component Object Model Hijacking

                                                                                1
                                                                                T1546.015

                                                                                Hijack Execution Flow

                                                                                1
                                                                                T1574

                                                                                DLL Search Order Hijacking

                                                                                1
                                                                                T1574.001

                                                                                Defense Evasion

                                                                                Hijack Execution Flow

                                                                                1
                                                                                T1574

                                                                                DLL Search Order Hijacking

                                                                                1
                                                                                T1574.001

                                                                                Masquerading

                                                                                1
                                                                                T1036

                                                                                Match Legitimate Name or Location

                                                                                1
                                                                                T1036.005

                                                                                Modify Registry

                                                                                3
                                                                                T1112

                                                                                Subvert Trust Controls

                                                                                2
                                                                                T1553

                                                                                Install Root Certificate

                                                                                2
                                                                                T1553.004

                                                                                Credential Access

                                                                                Credentials from Password Stores

                                                                                1
                                                                                T1555

                                                                                Credentials from Web Browsers

                                                                                1
                                                                                T1555.003

                                                                                Unsecured Credentials

                                                                                1
                                                                                T1552

                                                                                Credentials In Files

                                                                                1
                                                                                T1552.001

                                                                                Discovery

                                                                                Network Share Discovery

                                                                                1
                                                                                T1135

                                                                                Peripheral Device Discovery

                                                                                2
                                                                                T1120

                                                                                Query Registry

                                                                                6
                                                                                T1012

                                                                                System Information Discovery

                                                                                6
                                                                                T1082

                                                                                System Location Discovery

                                                                                1
                                                                                T1614

                                                                                System Language Discovery

                                                                                1
                                                                                T1614.001

                                                                                System Network Configuration Discovery

                                                                                1
                                                                                T1016

                                                                                System Time Discovery

                                                                                1
                                                                                T1124

                                                                                Lateral Movement

                                                                                Collection

                                                                                Data from Local System

                                                                                1
                                                                                T1005

                                                                                Command and Control

                                                                                Exfiltration

                                                                                Impact

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                snt.dat.bac
                                                                                • Path C:\PROGRA~2\PREMIE~1\snt.dat.bac
                                                                                • Size 3.4MB
                                                                                • SHA256 152752e6223000082fd2125b3779b37075b965252506fd965fa41cf95f5d006f
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                snt.dat.bac
                                                                                • Path C:\PROGRA~2\PREMIE~1\snt.dat.bac
                                                                                • Size 3.4MB
                                                                                • SHA256 ebf4097a71154cdba149b298d1e97e53b11773728e1743cdff4e44136e6d06aa
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                cacert.pem
                                                                                • Path C:\Program Files (x86)\PremierOpinion\cacert.pem
                                                                                • Size 3KB
                                                                                • SHA256 9f19e7a7139cca8373b516ab1ae49c644aa1c8048e8c7aa5784774a081dcbb87
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                pmoci.bin
                                                                                • Path C:\Program Files (x86)\PremierOpinion\pmoci.bin
                                                                                • Size 4KB
                                                                                • SHA256 20b0f94844860501e115fccd5c1462b2e2c932041d7989dc51c6d885b3429d8a
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                pmocid.bin
                                                                                • Path C:\Program Files (x86)\PremierOpinion\pmocid.bin
                                                                                • Size 4KB
                                                                                • SHA256 7d33a4271d7a1490a46764cd5b7403688c0a5972de5cf92a4afe9dcaa2331bfc
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Glory.exe
                                                                                • Path C:\Program Files\Glory\Glory.exe
                                                                                • Size 2.0MB
                                                                                • SHA256 ed5cbcf665707eaf69ad725cb17d8750cd60a8219b256090aa1a865364b379d1
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                hgsdk.dll
                                                                                • Path C:\Program Files\Glory\hgsdk.dll
                                                                                • Size 7.4MB
                                                                                • SHA256 2720d215168108700767f8e9b57819d55ca139d69d8d828186da186850a37c6c
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                installed-release.manifest
                                                                                • Path C:\Program Files\Glory\installed-release.manifest
                                                                                • Size 1KB
                                                                                • SHA256 73374afa3f9826e43f866e4acce7819cbe137afa1fe63101a44089c0fe066c98
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                103621DE9CD5414CC2538780B4B75751
                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
                                                                                • Size 808B
                                                                                • SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                1B1495DD322A24490E2BF2FAABAE1C61
                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
                                                                                • Size 355B
                                                                                • SHA256 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                22D536C4B4AD2CEF7AC6B7789FD235E3
                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3
                                                                                • Size 283B
                                                                                • SHA256 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                • Size 471B
                                                                                • SHA256 553585c12d481f55d436b51a0e5bb4cc758527496c6b1c1e7850e3c03d5b2cf9
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                • Size 471B
                                                                                • SHA256 70222408e33fc57a7d865964bf97bfd0422b199c55cbae0b71e5ea3dd054e99c
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                EBEC1B0159931C0BC6050AFFFBB02062
                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EBEC1B0159931C0BC6050AFFFBB02062
                                                                                • Size 278B
                                                                                • SHA256 e6e7be15b9eda21af3ce3db183b14f1db4cc69a2cbc53f3bc30acc629e6e1e18
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                103621DE9CD5414CC2538780B4B75751
                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
                                                                                • Size 192B
                                                                                • SHA256 1b2d16a7c500b0ed3e1c43d77abd0a0a7b01436bd63f95086e5f8b3556d41567
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                1B1495DD322A24490E2BF2FAABAE1C61
                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
                                                                                • Size 192B
                                                                                • SHA256 9fbc120cf5fe09b0070b72c675b48796fa3578f96814a7d088bbec54947843f5
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                22D536C4B4AD2CEF7AC6B7789FD235E3
                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3
                                                                                • Size 192B
                                                                                • SHA256 1592991fd3bac3b69bb97502d6936345db111bd97b3d14a24cd60f8bf5f6acfc
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                • Size 400B
                                                                                • SHA256 5811c4713142d573b51fc8cf95344d858da7ee23dd7fc8a23fac5c0f205580cb
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                • Size 416B
                                                                                • SHA256 48b3f792976f06af0391cc21834d8a5ba3b6f827c3ee11f440238d65ee873265
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                EBEC1B0159931C0BC6050AFFFBB02062
                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EBEC1B0159931C0BC6050AFFFBB02062
                                                                                • Size 484B
                                                                                • SHA256 73733abd2874316574ecbc246b2f3822ce5b0d0db2d80b2dda884ca544818d97
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                device-credential.dat
                                                                                • Path C:\Users\Admin\AppData\Local\Glory\device-credential.dat
                                                                                • Size 468B
                                                                                • SHA256 10b18737bd8467477a30adbc71e94d191289435702ec9ec1f720197c9b9c25cf
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                telemetry-queue.db
                                                                                • Path C:\Users\Admin\AppData\Local\Glory\telemetry-queue.db
                                                                                • Size 16KB
                                                                                • SHA256 56c47fa3b614a0b6eb6ad48e47607104ec78e89f472d5687c92b977d57344896
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                telemetry-queue.db
                                                                                • Path C:\Users\Admin\AppData\Local\Glory\telemetry-queue.db
                                                                                • Size 16KB
                                                                                • SHA256 02b8137d44986f879c97a62529d90724d6cbd1c9144b01e31bd77afa32c58b78
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                aichat_2.0.3_x64-setup[1].exe
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2650NSE1\aichat_2.0.3_x64-setup[1].exe
                                                                                • Size 3.6MB
                                                                                • SHA256 6430a772eb047467aa0c3e4bc964719dbf85b9adc58e63738a8652099ba6f8ec
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                ContentI3[1].exe
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\A8BWWIVW\ContentI3[1].exe
                                                                                • Size 3.8MB
                                                                                • SHA256 ef2734657b11113a433abb7ebac962e2bf6bf685f05c5f672997f01875430168
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                log-conversion[1].json
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\A8BWWIVW\log-conversion[1].json
                                                                                • Size 16B
                                                                                • SHA256 6489d6d7a33c5d40e18fc61eeb6c34c341279ee61816394dde5189aa4ad8fae5
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                rule18[1].xml
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\A8BWWIVW\rule18[1].xml
                                                                                • Size 128B
                                                                                • SHA256 9dfedfc7fa656ed83c4c5d9c517a694f59d6c1a40af31082d3ce011d28467591
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                DSForWindows_2_1[1].zip
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E8WK4YG5\DSForWindows_2_1[1].zip
                                                                                • Size 8.8MB
                                                                                • SHA256 a5636a60aa40b5e3903bafd8a45f5be1f4f66314391dd164aa641b110246c556
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                OperaGX_20740.exe
                                                                                • Path C:\Users\Admin\AppData\Local\OperaGX_20740.exe
                                                                                • Size 4.0MB
                                                                                • SHA256 c9dd05a6156e7e5071bc74a975f123503245bbff9acd9fa0938f9a5f69328ba7
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Opera GX Browser.lnk
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\Opera GX Browser.lnk
                                                                                • Size 1KB
                                                                                • SHA256 7ba9f5776efdb4928e0d50b81b348ac43723ffac8dba5e5bbe2c5856e0c819da
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                additional_file1.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\additional_file1.tmp
                                                                                • Size 3.2MB
                                                                                • SHA256 8d1e4a8a13191d403e17a993896355662aa334be3bc865e16aa7286096ae7ee2
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                assistant_installer.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\assistant\assistant_installer.exe
                                                                                • Size 2.5MB
                                                                                • SHA256 47022db9ccfec3e7e2d7e370c634f8ecd709a52c998d50a182108b0ef98cc0be
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                dbgcore.DLL
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\assistant\dbgcore.DLL
                                                                                • Size 238KB
                                                                                • SHA256 e4e5cbdd1d1da29cd7bfa36379824041111c9f820c1737614fd677e0ca38623e
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                dbghelp.dll
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\assistant\dbghelp.dll
                                                                                • Size 589KB
                                                                                • SHA256 5ae4f4925678573357af66ad2eb5b99e1cd84d33a98aa909af9683fb902277f0
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                installer_prefs_include.json
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\installer_prefs_include.json
                                                                                • Size 342B
                                                                                • SHA256 fb7cdb9c77d5ad7aedda521cbf5ae9be94529a4deb26143050ef5126b2f3acc2
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                installer_prefs_include.json577b128c-a3d6-4ebd-ad09-3ef88f898a74.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\installer_prefs_include.json577b128c-a3d6-4ebd-ad09-3ef88f898a74.tmp
                                                                                • Size 357B
                                                                                • SHA256 cae761046f38f0e96db4c41ad603539d63c5e465c26c1fec30320a78a6ab5d96
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                installer_prefs_include.jsond5768939-ff26-4630-9bfb-09c55b783bd5.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\installer_prefs_include.jsond5768939-ff26-4630-9bfb-09c55b783bd5.tmp
                                                                                • Size 1KB
                                                                                • SHA256 fecba4870c71ba2bec24ca28d59cda117503e8c385946002b1c1f364c0de7391
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                custom_partner_content.json
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\fa149e49-4c84-49bf-abd6-6c1fb6ee84f7 Opera GX Installer Temp\opera_package_202610300348081\resources\custom_partner_content.json
                                                                                • Size 245KB
                                                                                • SHA256 84bc1efb211c6b45f2906278a36f1414922f994a9611bbee7713ffd4ae21e967
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                installer.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\7zS8059A469\installer.exe
                                                                                • Size 9.2MB
                                                                                • SHA256 881306fe79419ad72de3a450a25e1a87ef7c087cefe121bcf452dd5d4eead7e3
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                GLY5B84.tmp.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\GLY5B84.tmp.exe
                                                                                • Size 433KB
                                                                                • SHA256 7baeed12fb8cdd76d09cd4cf51c0d72da4743af12cf9f5214363d2cf10debcfe
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                sciter.dll
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\GlorySetup-2A900F96-2595-4728-9A5C-ABE151435752\staged\sciter.dll
                                                                                • Size 18.4MB
                                                                                • SHA256 8ec04a9f38c3cbc376d11330d9022b830dafa0d27cd4ac89f4ab87ed8b883270
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Glory_CreateStartupTask.ps1
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Glory_CreateStartupTask.ps1
                                                                                • Size 1KB
                                                                                • SHA256 a052536bcec47a3b2c63dcf49123aa3c89b9c01535a6ae02858b8d15e845c925
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                Glory_log.txt
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Glory_log.txt
                                                                                • Size 84B
                                                                                • SHA256 ce1c3779f8db82f4eb0f03fd9c00c0b3ec5074c8d33fb6150bb8cd59ebf2dee3
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                Glory_log.txt
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Glory_log.txt
                                                                                • Size 128B
                                                                                • SHA256 ad6e022367c66278d72c29ec7da146b2daae914e96f2912341ff6280132431ce
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                Glory_log.txt
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Glory_log.txt
                                                                                • Size 170B
                                                                                • SHA256 61f7041fd0cfe4840d7c6550b9446bbaa034aa35536299cfed5bf5230fa6489d
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                Glory_log.txt
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Glory_log.txt
                                                                                • Size 212B
                                                                                • SHA256 d79f69ef70fae73a831b3f036fd23fd451623bca0d5af099f59f0942f50c2653
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                __PSScriptPolicyTest_eikek41v.os4.psm1
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eikek41v.os4.psm1
                                                                                • Size 60B
                                                                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                aichat-startup.log
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\aichat-startup.log
                                                                                • Size 411B
                                                                                • SHA256 17baad187095e8ab230e7385d2d081ffc23e5d526f4f3b92c8fda7686de0d59b
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                System.dll
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsbDD97.tmp\System.dll
                                                                                • Size 12KB
                                                                                • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                nsis_tauri_utils.dll
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsbDD97.tmp\nsis_tauri_utils.dll
                                                                                • Size 33KB
                                                                                • SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                pmls.dll
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\~os3182.tmp\pmls.dll
                                                                                • Size 884KB
                                                                                • SHA256 e471da417462c9f60181c27efe2355db4f0b3b4df6bd0d4097864a72677d8e5d
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                pmls64.dll
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\~os3182.tmp\pmls64.dll
                                                                                • Size 1.1MB
                                                                                • SHA256 877c2894f42bf078dfa36f06b543490d800a32c4f5245464bfec300b56867661
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                pmph.dll
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\~os3182.tmp\pmph.dll
                                                                                • Size 806KB
                                                                                • SHA256 7cdd0b4b6492483d07ddd1869ea4c213d8d5043aec14117b1a5926093bedc7e1
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                pmropn.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\~os3182.tmp\pmropn.exe
                                                                                • Size 7.4MB
                                                                                • SHA256 b8e134c1518903be8b260f821d1896b521f7f70956090562b3cc71b71bf8cb1b
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                pmropn32.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\~os3182.tmp\pmropn32.exe
                                                                                • Size 244KB
                                                                                • SHA256 b56a74fbe9b0a0c027f230a412dd69afbb697c41f31635352b37fe74d334fc15
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                pmropn64.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\~os3182.tmp\pmropn64.exe
                                                                                • Size 303KB
                                                                                • SHA256 f6de7618e24c0731e5ff77aa56f200d3c0e30e672a63c7d11b9717ece29e6814
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                pmservice.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\~os3182.tmp\pmservice.exe
                                                                                • Size 4.6MB
                                                                                • SHA256 f76c45ac8440c5a36096d7956bdf933bfff268469d1a73573c7f001f790dafa1
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                aichat.exe
                                                                                • Path C:\Users\Admin\AppData\Local\aichat\aichat.exe
                                                                                • Size 13.1MB
                                                                                • SHA256 b085082eb2af43465549651cb3cd42145861f8f9d7de68b2e37a5671a09c0a68
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                577fd4f1-b011-4b87-96a7-56284f7df199.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\577fd4f1-b011-4b87-96a7-56284f7df199.tmp
                                                                                • Size 15KB
                                                                                • SHA256 9fe9219cd041752f32140fd19b4083bc0b2481fd66f653d2467250037fe3a926
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                settings.dat
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Crashpad\settings.dat
                                                                                • Size 280B
                                                                                • SHA256 51f7ab75f54dfe7cbc891e2c66b7f917650b44e3a456b43c214c89f078cecbbd
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                settings.dat
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Crashpad\settings.dat
                                                                                • Size 280B
                                                                                • SHA256 02c6d31b9fbb53d929af121de39f4666cd9bd56ab2419f257171dd658f2687af
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                throttle_store.dat
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Crashpad\throttle_store.dat
                                                                                • Size 20B
                                                                                • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                temp-index
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Code Cache\js\index-dir\temp-index
                                                                                • Size 144B
                                                                                • SHA256 bb22f330e12ae0dce676f048dc3d59ee4223bdc69e280a903bcbce3cdc76cc4e
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                the-real-index
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                • Size 48B
                                                                                • SHA256 2bb0c836765f759e3135fe6089e359e4245f0035badfe0067734833fdbf97b80
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                CURRENT
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Extension Rules\CURRENT
                                                                                • Size 16B
                                                                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                9d69e740-37ec-409d-b567-7f5bfb397653.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Network\9d69e740-37ec-409d-b567-7f5bfb397653.tmp
                                                                                • Size 111B
                                                                                • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                Network Persistent State
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Network\Network Persistent State
                                                                                • Size 59B
                                                                                • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                SCT Auditing Pending Reports
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Network\SCT Auditing Pending Reports
                                                                                • Size 2B
                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                Preferences
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Preferences
                                                                                • Size 6KB
                                                                                • SHA256 d55efa7b0e907acb0f199be2a0bae0206ff7bd078b0e8aea94ba74e055304fe3
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                de24c91e-27bb-4d63-9b89-166aa2c4abef.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\de24c91e-27bb-4d63-9b89-166aa2c4abef.tmp
                                                                                • Size 6KB
                                                                                • SHA256 e29a2502f0db38e3c17ad9c3a96aeaf556a329009e36ca78aa279b7de2c73390
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                MANIFEST-000001
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
                                                                                • Size 41B
                                                                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                data_0
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\GrShaderCache\data_0
                                                                                • Size 8KB
                                                                                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                Submit Download

                                                                                data_1
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\GrShaderCache\data_1
                                                                                • Size 264KB
                                                                                • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                Submit Download

                                                                                data_2
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\GrShaderCache\data_2
                                                                                • Size 8KB
                                                                                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                Submit Download

                                                                                data_3
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\GrShaderCache\data_3
                                                                                • Size 8KB
                                                                                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Local State
                                                                                • Size 1KB
                                                                                • SHA256 a165dc87f17045302499a9f98a32e9252507e25233a7a6000b39141cdd264807
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                b00bd40e-4a56-4f46-83cf-1c2a82966a6c.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\b00bd40e-4a56-4f46-83cf-1c2a82966a6c.tmp
                                                                                • Size 3KB
                                                                                • SHA256 003c645d607d8d6fa991ffb7d350248237cc8af181f68747c51047e449d2aeb2
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ed4e8530-5e3b-4834-8b19-96b854be3db3.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\ed4e8530-5e3b-4834-8b19-96b854be3db3.tmp
                                                                                • Size 2KB
                                                                                • SHA256 a7f408803b27eb74b46a41ec9bbf54197edbf5be720b801c3b9774e02c17a0dd
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                settings.dat
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
                                                                                • Size 40B
                                                                                • SHA256 3cd15710eb579a707699a3559e2077a84ca3e5949f25c2b53d88add928ffb09e
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                Bookmarks
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Bookmarks
                                                                                • Size 22KB
                                                                                • SHA256 76ffa1280e01d87c6312e71fd0602bfae10eca04b4420e5c29170b07cd9a090b
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Bookmarks61d80566-870b-4606-90b5-96955138920a.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Bookmarks61d80566-870b-4606-90b5-96955138920a.tmp
                                                                                • Size 23KB
                                                                                • SHA256 4ca6ac2e75fc5de1d0f4f8c6b063f90a8cfdb876a87c0c08f10b29339456fb32
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                temp-index
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\temp-index
                                                                                • Size 504B
                                                                                • SHA256 1a65963394160a78d80ad64c70cbab35289c5fbfb79b893495a1d50516011a95
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                the-real-index
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
                                                                                • Size 48B
                                                                                • SHA256 1b10e6212ec0983cc7220787186775eac999f1f0d220e43b605e121b3fefcac0
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                index
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\wasm\index
                                                                                • Size 24B
                                                                                • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                Opera Custom Icon.ico3673bcbc-fe7e-4acc-b269-8a2778798873.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Opera Custom Icon.ico3673bcbc-fe7e-4acc-b269-8a2778798873.tmp
                                                                                • Size 162KB
                                                                                • SHA256 5903c920e584fc5f1e918bd641bf58fd56e8cb20bb68269892a4984ea7538621
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Preferences
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences
                                                                                • Size 11KB
                                                                                • SHA256 bc1faa49957ed8a9686450eb4795639ec409b4d4fa6f6ed322307b88dd44da68
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Preferences008c41b3-e7b3-4baa-8cbb-01607de93491.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences008c41b3-e7b3-4baa-8cbb-01607de93491.tmp
                                                                                • Size 15KB
                                                                                • SHA256 40ef7c310582811bf5682122d782caf5060bec0df0ebe4a9faff9a48469805a0
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Secure Preferences
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Secure Preferences
                                                                                • Size 79KB
                                                                                • SHA256 31221eee795ffdb0ecce3338f65c7ceb0350f5ab960faa79ca3932c3f64617ec
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Secure Preferences84034aa9-0309-4f45-911b-b27350079160.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Secure Preferences84034aa9-0309-4f45-911b-b27350079160.tmp
                                                                                • Size 80KB
                                                                                • SHA256 ac27207224b060f39829aef843459e92f68f2cc307206a705c7089de3a344632
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                temp-index
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\temp-index
                                                                                • Size 96B
                                                                                • SHA256 9ee342ace3d7e609f3700de276a5c9ef8b5edf523d11a66f107d0b359a1c1cf2
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                the-real-index
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                • Size 72B
                                                                                • SHA256 f074ea69b1917ca99d9c590e4e80db8cdaa3092f5d6d1556fd43bb7aa525fa39
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw
                                                                                • Size 429B
                                                                                • SHA256 c286a5d68cf04079c201c4d86d9df9ac9bdd01d457480afb0dfe362134c0b450
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw02d97d0e-33a4-4b5a-9d04-e5ad2a48f460.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw02d97d0e-33a4-4b5a-9d04-e5ad2a48f460.tmp
                                                                                • Size 9KB
                                                                                • SHA256 6f8a072c868fc0efaa6552d40b629622497c0f7d0589864b925f64f98fa78981
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw130a9f3e-187e-4de7-bbfa-e907cc5f933f.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw130a9f3e-187e-4de7-bbfa-e907cc5f933f.tmp
                                                                                • Size 2KB
                                                                                • SHA256 951f416a3aa9c9791c42be33cfedc24d6aa6b9c43dc7d82486dcdf33384da302
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw167c9583-dff8-420d-be9e-029d4d4a47b6.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw167c9583-dff8-420d-be9e-029d4d4a47b6.tmp
                                                                                • Size 1KB
                                                                                • SHA256 610b71b4f80c4444a38df353a4a2407774cec0124b3f53175854b5533d30b925
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw16dc5212-07c2-4dcd-a048-c8ea42dcc051.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw16dc5212-07c2-4dcd-a048-c8ea42dcc051.tmp
                                                                                • Size 10KB
                                                                                • SHA256 404b817284a810b0929a1384bcb6f0204b354b46e0312f95b385adcfbf8051f6
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw1e6f18fc-66de-466f-bbb2-123666d9d334.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw1e6f18fc-66de-466f-bbb2-123666d9d334.tmp
                                                                                • Size 9KB
                                                                                • SHA256 253caaff4cfd94206d13900347e672077da8297382dd10e6d0a9716c7fd182e6
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw2f8b6034-e38c-4f55-90bf-58e04e3b1977.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw2f8b6034-e38c-4f55-90bf-58e04e3b1977.tmp
                                                                                • Size 9KB
                                                                                • SHA256 f9bffd2546ad057850f3fb30ec1ccddf59d8b3b82083cab0f6a34da98c021fa9
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw3079064f-c074-462f-a865-8996d1f4d969.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw3079064f-c074-462f-a865-8996d1f4d969.tmp
                                                                                • Size 10KB
                                                                                • SHA256 6d43dd246d45f6c1152d3205f87ffcf95352e59ffb718ef340462c5ac944fd01
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw334556e9-042e-4ed4-a36c-57e9dbe0e36c.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw334556e9-042e-4ed4-a36c-57e9dbe0e36c.tmp
                                                                                • Size 9KB
                                                                                • SHA256 7662ab119c96375ab60c11b25e9f7ec2394053df6af5eff1561efa50c3a56a3e
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw365cc4f0-fa10-4b33-ad6d-6b4a92fec9e9.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw365cc4f0-fa10-4b33-ad6d-6b4a92fec9e9.tmp
                                                                                • Size 10KB
                                                                                • SHA256 89f080dd84a55bff0548d76773914ecd3093085d19f15addee629fa9e4b857d0
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw367dbf0e-e4df-4252-9b9e-d4af26b8614a.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw367dbf0e-e4df-4252-9b9e-d4af26b8614a.tmp
                                                                                • Size 2KB
                                                                                • SHA256 18cd8d0ad49716c99b2372c8fa154efb7c189658b10ae2e9132089bbfae0de2d
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw39795746-c82d-4c1a-9faf-75aae241ab9a.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw39795746-c82d-4c1a-9faf-75aae241ab9a.tmp
                                                                                • Size 8KB
                                                                                • SHA256 d047e008d0b93a0f7680b184ef0a7c7516bd4d451f3f4d2cb529dcaee6a872bd
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw4271673a-9263-4167-b3fb-fc99dda0bbd5.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw4271673a-9263-4167-b3fb-fc99dda0bbd5.tmp
                                                                                • Size 1KB
                                                                                • SHA256 b34f5189850f13dfa0c9eebccd6b7cd9a14d847939e7d50bb29e626edfeb4efe
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw433cd40d-4e88-4dc1-aa37-ae87e2d95c40.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw433cd40d-4e88-4dc1-aa37-ae87e2d95c40.tmp
                                                                                • Size 8KB
                                                                                • SHA256 014bf379a3745a66fd14efd394ff84320123bb32fb34645ef1486877e3a4b6b3
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw44954ddb-4227-4a79-8d88-236c3a3f7f72.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw44954ddb-4227-4a79-8d88-236c3a3f7f72.tmp
                                                                                • Size 9KB
                                                                                • SHA256 fbe64382ae241f5914b90bcc6dc1fdf786b726c059e374f1678255fb6628b448
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw4700b2a9-143b-42a2-b85a-3a6b30f65e24.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw4700b2a9-143b-42a2-b85a-3a6b30f65e24.tmp
                                                                                • Size 8KB
                                                                                • SHA256 19e3fb4db191736074cafdfceae5c99e79643648abcb4ad58e1627f827871b4f
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw4d8b8ad5-2d4c-4ae0-bf95-59c401c9c567.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw4d8b8ad5-2d4c-4ae0-bf95-59c401c9c567.tmp
                                                                                • Size 9KB
                                                                                • SHA256 4d8173bc31c4993547d7a8e504ace525a82651e2ce40f359dc57385c9a0e676e
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw4e5ec126-8551-47f2-a10c-a84816ec1560.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw4e5ec126-8551-47f2-a10c-a84816ec1560.tmp
                                                                                • Size 9KB
                                                                                • SHA256 575fb878a98fdbc1aba857d85fb6924c2cb7739212d0b70b054f5acac72b63de
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw4efcf960-4d20-4b07-9fdc-83977ed3eeb2.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw4efcf960-4d20-4b07-9fdc-83977ed3eeb2.tmp
                                                                                • Size 9KB
                                                                                • SHA256 e4937c75324b621d8dacc83c8b0f763d20a0ce99ec001b57867f1c1cf87a35a5
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw4ff69145-8a85-4301-8373-f4ef0ec3f10d.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw4ff69145-8a85-4301-8373-f4ef0ec3f10d.tmp
                                                                                • Size 9KB
                                                                                • SHA256 771aaabe321236bb2035516addcc022deb863cc5fe7476c3c05d96417c9c1a94
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw62b3d3f3-f8dc-4544-b1e1-26bd044043a7.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw62b3d3f3-f8dc-4544-b1e1-26bd044043a7.tmp
                                                                                • Size 10KB
                                                                                • SHA256 bb6eb202bf2b4b550f5d19796d3a98d4a7e368b750d1f347cc0c50e41340ae95
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw6633cd4e-4e68-4013-96d8-a66a7ed7b32d.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw6633cd4e-4e68-4013-96d8-a66a7ed7b32d.tmp
                                                                                • Size 781B
                                                                                • SHA256 e8c803bdf1387c15305423b59827b6c64022a40c4a24d751a754d4ddcbf93744
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw66537966-bb6f-4eab-b393-073c6d031f84.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw66537966-bb6f-4eab-b393-073c6d031f84.tmp
                                                                                • Size 10KB
                                                                                • SHA256 561678789a11cb810483349b2b13b90a95a76e28ff0ccb48061879ad2dcb8b11
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw67bf9097-a02b-4133-8be8-5c0c2fb13b47.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw67bf9097-a02b-4133-8be8-5c0c2fb13b47.tmp
                                                                                • Size 1KB
                                                                                • SHA256 dbf27c1a973cdefc05d07642a8d8852def959add3cb567343e56fecba6dfdda9
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw85fa5394-721d-402b-9fad-0286676cd108.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw85fa5394-721d-402b-9fad-0286676cd108.tmp
                                                                                • Size 1KB
                                                                                • SHA256 3ccf90b90e1cabf548605b94d3c3aafc67ef9d09d65d540b7303290b8fa3a76c
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw87de194d-32f3-4b03-81e7-3e1ef1ca880f.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw87de194d-32f3-4b03-81e7-3e1ef1ca880f.tmp
                                                                                • Size 10KB
                                                                                • SHA256 75c737b321432c2a4c961e9a2fd368dae8544773fb5a2bdc6bf2e1c48e0345f6
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw91f71ad9-b3ee-4ead-8782-4e035ddc2583.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw91f71ad9-b3ee-4ead-8782-4e035ddc2583.tmp
                                                                                • Size 7KB
                                                                                • SHA256 fff1d3dd3b2dbf8edda584f048881840c89eaa3ee90d206186f9be1613f7a046
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw92e024d2-caa1-43dd-b318-cbd270b675cc.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw92e024d2-caa1-43dd-b318-cbd270b675cc.tmp
                                                                                • Size 9KB
                                                                                • SHA256 099856c1c516dc94340abf0292bfebdbe46b12485b6a712a1d99295cc267b7a1
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw98a25d12-aaf8-48c2-a72e-aa1bd0f16f82.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw98a25d12-aaf8-48c2-a72e-aa1bd0f16f82.tmp
                                                                                • Size 2KB
                                                                                • SHA256 e4e49a83293a7b53ef7f9029a75434a3b638ee446de25ce617f6a5d370cd83e8
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw9ec5fa2f-9cf2-43c0-938c-a2ae0d3461bd.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.raw9ec5fa2f-9cf2-43c0-938c-a2ae0d3461bd.tmp
                                                                                • Size 9KB
                                                                                • SHA256 6ae4ba261388476e9282da8c261ae1ca037a90500d0d6062dd7ff38d73f32070
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawa7bfb1dd-e20c-46c7-8aae-59020d83d90e.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawa7bfb1dd-e20c-46c7-8aae-59020d83d90e.tmp
                                                                                • Size 9KB
                                                                                • SHA256 8d31f843a7189f0d3c37cdce811df45cdb15c7e977e65c7de0d60f75c1797dc1
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawa7f461a6-bdbc-49bd-ad4a-99b6e4b43043.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawa7f461a6-bdbc-49bd-ad4a-99b6e4b43043.tmp
                                                                                • Size 541B
                                                                                • SHA256 dc8d145d260ae601a830570b303f87ac12aebc09a2d938751241d8dc544dbf39
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawb6e4894d-9772-4d3e-af76-d552b0c9ad81.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawb6e4894d-9772-4d3e-af76-d552b0c9ad81.tmp
                                                                                • Size 9KB
                                                                                • SHA256 a0b390f243cf887792240d85d9d00f54b1e7aef0ed9c13cface37a97b8425e49
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawb756d1fd-2967-4072-8da9-5daea47bf830.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawb756d1fd-2967-4072-8da9-5daea47bf830.tmp
                                                                                • Size 653B
                                                                                • SHA256 0f1945caf18cfb4177adf494ab740c508b17268ae739773c422508b4f0a59ac7
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawbca386d1-7354-479b-b4a0-506a2ad94ea3.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawbca386d1-7354-479b-b4a0-506a2ad94ea3.tmp
                                                                                • Size 10KB
                                                                                • SHA256 999144a23dedc7b0fd0c76311036b941851555d0e1033a59e34b3d95b482ff80
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawc51aa469-1c82-4ff6-8ec7-a335f35e9234.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawc51aa469-1c82-4ff6-8ec7-a335f35e9234.tmp
                                                                                • Size 7KB
                                                                                • SHA256 5506612088ed2d25a8962a5f8148aaec9b642713052f056a6e2401002067fba2
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawc5bf571f-db89-44f6-9d20-c6476f462416.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawc5bf571f-db89-44f6-9d20-c6476f462416.tmp
                                                                                • Size 1KB
                                                                                • SHA256 237a4f4decfdb29459d2bd17b1be41db09d3f3108b654ce924d55f950fbbcb2c
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawcd57b784-e8e1-48af-bf88-0c6970de4aa3.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawcd57b784-e8e1-48af-bf88-0c6970de4aa3.tmp
                                                                                • Size 10KB
                                                                                • SHA256 3ff49c2c808ba8afa91607c83cad0ce5c9ea4796e1199fd01d208cac72d962d2
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawcda057e9-983b-40b2-8119-2a76ca09376c.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawcda057e9-983b-40b2-8119-2a76ca09376c.tmp
                                                                                • Size 1KB
                                                                                • SHA256 5f3845723c6920a1535ee5f65e87631e657a7a6d472359a105636f6fa9b81102
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawd1755e1d-48d4-44ec-976d-6a7fd0a48c07.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawd1755e1d-48d4-44ec-976d-6a7fd0a48c07.tmp
                                                                                • Size 2KB
                                                                                • SHA256 084d4deac1451884c28f72921c2b6428b119e36a49d7c3a33cd2f205d5a93ebb
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawd178492e-5de7-4395-85a2-a1aa5bfb1953.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawd178492e-5de7-4395-85a2-a1aa5bfb1953.tmp
                                                                                • Size 9KB
                                                                                • SHA256 6b2efbec99f8aa0ffa6c7730ac86c6a24a94cb8a3aaaa99d253b1807db946fdc
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawd8647721-6ae2-4bab-ba07-3f3afb254d44.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawd8647721-6ae2-4bab-ba07-3f3afb254d44.tmp
                                                                                • Size 10KB
                                                                                • SHA256 a153262d97ebc55a25510c2de03e4b80dbb7168a320a3ca4840942920060d95a
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawd90babc8-f2d0-44d6-9f3e-ab303ccf5d9c.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawd90babc8-f2d0-44d6-9f3e-ab303ccf5d9c.tmp
                                                                                • Size 1KB
                                                                                • SHA256 137e95e8f8a1efc92f6ac2e1ad0413ea32e4ac310e7344cb3607dd5f7e5d1a8b
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawde9704a7-a9cc-4aa2-8b41-9f802226a4fb.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawde9704a7-a9cc-4aa2-8b41-9f802226a4fb.tmp
                                                                                • Size 2KB
                                                                                • SHA256 f449a91f872da6ff56419f8123df30fa0ab06805a7e8a3ed03359c4116a3a975
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawdf5bbde9-6092-4037-9ad1-0de1b1baf218.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawdf5bbde9-6092-4037-9ad1-0de1b1baf218.tmp
                                                                                • Size 2KB
                                                                                • SHA256 23069863407d5eb76abc955dde5d5a1e90d75ab6fb07320893d33ba4de9234f7
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawdfdee813-b0b6-4b0c-81f7-4a7f69e605e2.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawdfdee813-b0b6-4b0c-81f7-4a7f69e605e2.tmp
                                                                                • Size 9KB
                                                                                • SHA256 3021802fa1e0d083959bf8e9ac1c92bec0a590751a2fea3c11622f1726453508
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawe2c35126-7593-4c78-ad6e-8e298ef2bbb7.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawe2c35126-7593-4c78-ad6e-8e298ef2bbb7.tmp
                                                                                • Size 10KB
                                                                                • SHA256 06473961593c0c482735e90c48eab2c32e0c11513ab2200c3a4ccd8ebe838d05
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawe6a63065-75ac-40cc-aa8b-51a6b24e142f.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawe6a63065-75ac-40cc-aa8b-51a6b24e142f.tmp
                                                                                • Size 1KB
                                                                                • SHA256 149ce6c9ce97539f0af3615afa0bd0ed9af33dfb95e4e60b528384618aa2a197
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawfadfa978-f261-4703-acb7-9bca1c110434.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawfadfa978-f261-4703-acb7-9bca1c110434.tmp
                                                                                • Size 973B
                                                                                • SHA256 326c50fb4679ca8204467480c66f76d1f3aca659238ae366b92897efde09bbc0
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawfc094ef7-d416-401e-ad39-2d04f4dfb570.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawfc094ef7-d416-401e-ad39-2d04f4dfb570.tmp
                                                                                • Size 2KB
                                                                                • SHA256 5216e0960b1e399b1bac06e32f4c89a9ebd9d0ba1eadc3861816afcdcd271c9b
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawfe2b20e7-5488-4abc-adef-ca74e28ea13f.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawfe2b20e7-5488-4abc-adef-ca74e28ea13f.tmp
                                                                                • Size 10KB
                                                                                • SHA256 67827a8d67838f26697855cabcff5f05892a5f610b4cdebb005f2d5e832c3076
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawfe451e8e-7461-4b8f-8c49-5ef186e8c42e.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_7445e04d-9884-483c-a011-7023a5c5e8d5.rawfe451e8e-7461-4b8f-8c49-5ef186e8c42e.tmp
                                                                                • Size 10KB
                                                                                • SHA256 e9b3eefe85adc45ec09a017300e769f113984c29ab1198ba4e9fb5d991e1ab9b
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                ssdfp2468.0.1078549889
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.0.1078549889
                                                                                • Size 357B
                                                                                • SHA256 582ba81c1580d6299bdfb953b9c0de82dc75fcf2e2065ff60af2cea8f6259f32
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.0.107854988919803076-9bf9-40dc-9379-abd991a91f18.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.0.107854988919803076-9bf9-40dc-9379-abd991a91f18.tmp
                                                                                • Size 1KB
                                                                                • SHA256 9ad69c8dcb898d0954b9d6e24a2f9f842fc1c4ada9b863dd4549b3f0cb7fccb5
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.0.107854988923f2f841-52f2-4fe5-ad1e-b67c5c3f2e0d.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.0.107854988923f2f841-52f2-4fe5-ad1e-b67c5c3f2e0d.tmp
                                                                                • Size 2KB
                                                                                • SHA256 e1b36c5931104f13afad54650d0dbd21bc4e7e0ce5d9fb44b09a9d96077e4ac9
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.0.1078549889274c4c4e-417f-4b2d-a14b-59feab0d7420.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.0.1078549889274c4c4e-417f-4b2d-a14b-59feab0d7420.tmp
                                                                                • Size 2KB
                                                                                • SHA256 078b24243742690f160dcea36d152de1ad73261b8d86adb6a2cb9a3c1afa6a69
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.0.10785498893813418d-3df1-4ec6-a264-54ddaaea52e9.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.0.10785498893813418d-3df1-4ec6-a264-54ddaaea52e9.tmp
                                                                                • Size 2KB
                                                                                • SHA256 cba8f1147f9b3f05bb3e7b8e0f50c8384834f6d2117499d8b5f105ac8170538d
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.0.1078549889953c6a5c-d70e-4dde-a457-a1c84691d164.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.0.1078549889953c6a5c-d70e-4dde-a457-a1c84691d164.tmp
                                                                                • Size 2KB
                                                                                • SHA256 576b623266c0f1f6c602e042c527c40ddd5916777a9edc347b61f6c4a4f13d8d
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.0.107854988999f6b1dc-9e75-42b1-9760-b2e9a3732d16.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.0.107854988999f6b1dc-9e75-42b1-9760-b2e9a3732d16.tmp
                                                                                • Size 2KB
                                                                                • SHA256 05ad69b3232bfd12028a9b3413bb1c0a4e9ff53884e324b171ac156044a831a8
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.0.10785498899a548691-6713-4742-b402-dd96a52a0830.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.0.10785498899a548691-6713-4742-b402-dd96a52a0830.tmp
                                                                                • Size 2KB
                                                                                • SHA256 aa83f85092d4a61b566fbfa70924022757ea7de7a4f151096f4b6951edcdbe18
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.0.1078549889df576e07-9295-440d-b8a5-dd2d8b968a00.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.0.1078549889df576e07-9295-440d-b8a5-dd2d8b968a00.tmp
                                                                                • Size 578B
                                                                                • SHA256 e858c6c59b750cc4d4ad1d9f1cbab21b91bb7506fc33864e748bb26e69116408
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.0.1078549889e226f7f3-167d-48dd-b2b1-ea432e63bbd6.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.0.1078549889e226f7f3-167d-48dd-b2b1-ea432e63bbd6.tmp
                                                                                • Size 516B
                                                                                • SHA256 6320cd7b980434ad05cf7b518477a0f59a062a424b77117928de15da1f393788
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.0.1078549889f2e378c8-17ca-4ad8-8f5b-c7993e378810.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.0.1078549889f2e378c8-17ca-4ad8-8f5b-c7993e378810.tmp
                                                                                • Size 418B
                                                                                • SHA256 53c02574c2c4f1d75c11707c0a12cd3916b60a1fe3e751cbf57290a2c4b2112c
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.0.1078549889f8a8e971-ef8a-45de-9561-6f351d4547cb.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.0.1078549889f8a8e971-ef8a-45de-9561-6f351d4547cb.tmp
                                                                                • Size 1KB
                                                                                • SHA256 7032f7c76fea606df05b949050972cd2f74b8df158c1e9b4ad04fd13ec2a5322
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.0.1078549889fd6c0573-06ed-4367-be9a-6cfe42913608.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.0.1078549889fd6c0573-06ed-4367-be9a-6cfe42913608.tmp
                                                                                • Size 2KB
                                                                                • SHA256 b2c4fa376a0585fb9402802ed348a10f6fc38ab16b0ef4a76d1f1eb9dbeef13b
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.1239189328
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.1239189328
                                                                                • Size 171B
                                                                                • SHA256 403f2fb100ec47efc3eafcb551007da7ca65d4399f98706079968db74c2a74ed
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.12391893280282ea36-f41c-4b07-81d4-5bb944fedcb4.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.12391893280282ea36-f41c-4b07-81d4-5bb944fedcb4.tmp
                                                                                • Size 1KB
                                                                                • SHA256 2905ba45e5f3df8f909414c70e47ba274590c0e71667f1266dff6bb7a9873b61
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.123918932803cea900-359e-4417-ad51-15fbb09ec9e9.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.123918932803cea900-359e-4417-ad51-15fbb09ec9e9.tmp
                                                                                • Size 2KB
                                                                                • SHA256 920a41874b0f9d76057fcf3ddb17e27d42b894cfff6630d3d1950d6b11988d63
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.12391893283af96b22-9ed3-425c-bfe9-59edccfb872b.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.12391893283af96b22-9ed3-425c-bfe9-59edccfb872b.tmp
                                                                                • Size 1KB
                                                                                • SHA256 c6aa9db3785621b7f52fc7b844bf69d11e73f6790228c6a2ff99b72093a71650
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.12391893285a0a494a-686c-48ce-aa9f-75ab54e4ce24.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.12391893285a0a494a-686c-48ce-aa9f-75ab54e4ce24.tmp
                                                                                • Size 2KB
                                                                                • SHA256 2ab9b32fb1e29b854180f35deedd3b806e920735e3034d44f98d635bbae9f9f5
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.12391893286e4c8044-174b-4b07-8c06-a5d7b2940936.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.12391893286e4c8044-174b-4b07-8c06-a5d7b2940936.tmp
                                                                                • Size 326B
                                                                                • SHA256 f7bbade71f24263e5d0190670b7d47e0f422ba5e1f9895a41c2fb50ca2921097
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.1239189328728257e4-44ca-4aca-9a4a-8097d520c38a.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.1239189328728257e4-44ca-4aca-9a4a-8097d520c38a.tmp
                                                                                • Size 1KB
                                                                                • SHA256 36d6d8c17e3e4b69ba24ead5d55caea8606efce58c943ca12883dbecc499ad16
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.12391893287b55cbca-ec04-4b80-83e9-2ddc6ace7068.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.12391893287b55cbca-ec04-4b80-83e9-2ddc6ace7068.tmp
                                                                                • Size 3KB
                                                                                • SHA256 bed41abb648945ece551676c6a9dbe63aa23c6dae0b7ba58ff3e38ae8d0a5f1e
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.12391893287fba0c13-0688-4bbf-adff-7dd9edcf8a62.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.12391893287fba0c13-0688-4bbf-adff-7dd9edcf8a62.tmp
                                                                                • Size 1KB
                                                                                • SHA256 1261d920c836048c4134dd6f4693ac6bfef8156bcb15e948f7fa0fc1988a98eb
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.123918932884248d0b-93d1-4ecf-937a-8130c7fb459a.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.123918932884248d0b-93d1-4ecf-937a-8130c7fb459a.tmp
                                                                                • Size 1KB
                                                                                • SHA256 f7d5b601213a6d5bb30a7d711089c9a0e549ce8d9a26b60b3869b3f98aed2a96
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.123918932886178c5e-e368-4108-a985-30fd78776268.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.123918932886178c5e-e368-4108-a985-30fd78776268.tmp
                                                                                • Size 967B
                                                                                • SHA256 09666e5065b73e2e041c5de1aa3f296b8bef35ed264cfeebd44316e862a976a3
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.12391893288a2b92b8-765a-443f-b723-406b221fd47d.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.12391893288a2b92b8-765a-443f-b723-406b221fd47d.tmp
                                                                                • Size 200B
                                                                                • SHA256 9197a66b4bcb2c42d8c1a1077d278979a7f2f9887f53ad84e9c28ec169ff1d7e
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.12391893288f5e02ce-e4c4-468b-821b-9e17332edeeb.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.12391893288f5e02ce-e4c4-468b-821b-9e17332edeeb.tmp
                                                                                • Size 1KB
                                                                                • SHA256 189f27ed5a6323054827f68f550850a02dfdff20a7eb4ef6ec246f6ff42a507e
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.123918932892a5ad54-7934-4603-91f5-abff3063d98c.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.123918932892a5ad54-7934-4603-91f5-abff3063d98c.tmp
                                                                                • Size 418B
                                                                                • SHA256 2e6a64cb7f8fbb32dab1dc63874849ca3fbbc1a33dbb6ba3a6eb9ec09c7b749c
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.1239189328a2add344-a235-4388-afaa-33dddc352594.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.1239189328a2add344-a235-4388-afaa-33dddc352594.tmp
                                                                                • Size 3KB
                                                                                • SHA256 7aba574dc2dd6de4f81e785cda4e90eb8309aafc83b968a47abcb283296799e2
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.1239189328af731bb2-bf5a-4dbd-a763-b80658ea57d4.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.1239189328af731bb2-bf5a-4dbd-a763-b80658ea57d4.tmp
                                                                                • Size 3KB
                                                                                • SHA256 9c975c5306d901aa2cc46fedceb52b46d66501829af4a3e7d97124099f81e4a2
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.1239189328b0468c8c-65b2-4a83-9e6f-ef86bbd3ed91.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.1239189328b0468c8c-65b2-4a83-9e6f-ef86bbd3ed91.tmp
                                                                                • Size 3KB
                                                                                • SHA256 c3f87be9a66961d33e6ef5fea21b5697acb2bdd372c8d04a2a46f1e5346d98ae
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.1239189328b95767b8-12f9-435d-934d-84335a0103b3.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.1239189328b95767b8-12f9-435d-934d-84335a0103b3.tmp
                                                                                • Size 866B
                                                                                • SHA256 0c9ddf8ba93f9a2a55982d6cc6116548864194952d9f958d1989b3eb3b80ef60
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.1239189328c6460511-2b77-46b1-90a0-d60b44a5617c.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.1239189328c6460511-2b77-46b1-90a0-d60b44a5617c.tmp
                                                                                • Size 1KB
                                                                                • SHA256 fbc93f6bedbafc6649a84a33fd138f3fa1d06a7309239ec55ec30345bd33385e
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.1239189328c8b31ace-b67e-405b-8dc5-c5983e905d77.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.1239189328c8b31ace-b67e-405b-8dc5-c5983e905d77.tmp
                                                                                • Size 504B
                                                                                • SHA256 5478d49d55cfc74d5c1441879bda2dfba5457a97c12a30510ec2e693cb93f117
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.1239189328cf08ca4d-9a0e-4dd0-bad4-29659408ace7.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.1239189328cf08ca4d-9a0e-4dd0-bad4-29659408ace7.tmp
                                                                                • Size 776B
                                                                                • SHA256 f9f7040356a6860a704f1bbc285af720a74627a4af980197fb4651200c19ddcd
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.1239189328d317d6bb-1a80-4dc0-acca-5a3ec953be7e.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.1239189328d317d6bb-1a80-4dc0-acca-5a3ec953be7e.tmp
                                                                                • Size 3KB
                                                                                • SHA256 ee89313724df32ee9bd8a74e8420eff34dc953b7fc08c74046c1642ab359837e
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.1239189328d436c90a-10dc-4ad3-bf14-0b478a29a71b.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.1239189328d436c90a-10dc-4ad3-bf14-0b478a29a71b.tmp
                                                                                • Size 684B
                                                                                • SHA256 c7e316ac42779bd8de8cd2d0891a0def8897fa3c51b521df0a20d719c595a83d
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.1239189328d544bb66-d1ca-403f-a16f-b578b80ab028.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.1239189328d544bb66-d1ca-403f-a16f-b578b80ab028.tmp
                                                                                • Size 1KB
                                                                                • SHA256 acc9eee341d8599375b6c0d2bc788a0641df6a7b231ce1dd94ecd7b50cfa4501
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.1239189328dd37283f-281a-4d05-b616-67377db34d15.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.1239189328dd37283f-281a-4d05-b616-67377db34d15.tmp
                                                                                • Size 3KB
                                                                                • SHA256 a986472e9d207a3d746a73a2606f62405f948c88769ea2ee79a132e6b22deb3a
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.1239189328e115d8fd-ca46-4389-b5c7-27772ed64eb0.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.1239189328e115d8fd-ca46-4389-b5c7-27772ed64eb0.tmp
                                                                                • Size 593B
                                                                                • SHA256 2f343690410e911f10fcae6304698e7258fbe6f2a4a43c603bf5bebaeaecad95
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.1.1239189328fda86cbb-8e1d-47a6-b9b3-864a02711331.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.1.1239189328fda86cbb-8e1d-47a6-b9b3-864a02711331.tmp
                                                                                • Size 3KB
                                                                                • SHA256 f08ea7627c7e650e47d9c97f9beb40e4d5762c950d3179c15aeb238e44ea3c84
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.2.36595484
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.2.36595484
                                                                                • Size 173B
                                                                                • SHA256 a4de8f39f3b494a613a06c33882cc8323d112fd2aea8aa2466d45332e3c3f9d0
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                ssdfp2468.2.36595484d949bd66-b0a6-4690-bd68-8a8f55978e8d.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2468.2.36595484d949bd66-b0a6-4690-bd68-8a8f55978e8d.tmp
                                                                                • Size 217B
                                                                                • SHA256 205899b722a29c60638e763f1826ead20addc3b69a19b58fcebd3c8819cabb46
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Local State
                                                                                • Size 2KB
                                                                                • SHA256 b4a93ea4f2aadd6b47e2249c3772a1bc23781607cd62ecd6d29658c20dd84af5
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                Local Stateab021683-32ae-4363-b770-1c6109d14ed6.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Local Stateab021683-32ae-4363-b770-1c6109d14ed6.tmp
                                                                                • Size 3KB
                                                                                • SHA256 3d6058be0a7e0e7b1c07cdf4c7fc73e76ed573c0cf29d9e7a8092c73ed3402b3
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                VariationsSeedV2d22fc0ca-de90-4761-9f12-11c0570490ab.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\VariationsSeedV2d22fc0ca-de90-4761-9f12-11c0570490ab.tmp
                                                                                • Size 19B
                                                                                • SHA256 1560b22b2264f7cb6b7f6910164813f76c5e8a06fb1acf85b375e687ee49c1ad
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                VariationsSeedV2e9b3196c-8226-4261-ae72-78adc602bcdd.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\VariationsSeedV2e9b3196c-8226-4261-ae72-78adc602bcdd.tmp
                                                                                • Size 11B
                                                                                • SHA256 b4cc4174735c28360b9081be3c3d0552d8a4b3cdb54431ac00ed0d622bab6296
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                assistant_prefs.json0140a509-e8fa-47f0-8c81-4210862ffc72.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\assistant_prefs.json0140a509-e8fa-47f0-8c81-4210862ffc72.tmp
                                                                                • Size 151B
                                                                                • SHA256 c28a31fbd8eae2298f83bbb929c059ec06af1628e6bfa1decc307d20fc8c9749
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                assistant_prefs.json1306b5cb-41a6-48d0-8b0e-5643a281f404.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\assistant_prefs.json1306b5cb-41a6-48d0-8b0e-5643a281f404.tmp
                                                                                • Size 151B
                                                                                • SHA256 aa082c53507c902edba1b8cdf77eb7520d941da984074e4b1d08ad055b7f0615
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                assistant_prefs.json311be93f-67e7-49b1-bc8f-fe46f406b056.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\assistant_prefs.json311be93f-67e7-49b1-bc8f-fe46f406b056.tmp
                                                                                • Size 151B
                                                                                • SHA256 72b85b63fa4412673db1179ed16a84edd813ef1f9fd474c4a386389814520146
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                metadata.json8e14e32e-cc89-41ca-97c5-0d2ee02fc414.tmp
                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\extensions_crx_cache\metadata.json8e14e32e-cc89-41ca-97c5-0d2ee02fc414.tmp
                                                                                • Size 13B
                                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                manifest.json
                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1141094137\manifest.json
                                                                                • Size 108B
                                                                                • SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                manifest.json
                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1301458402\manifest.json
                                                                                • Size 80B
                                                                                • SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                manifest.json
                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1796130927\manifest.json
                                                                                • Size 102B
                                                                                • SHA256 0ed889bea99f74fede865222f4cacca4277c63023db98efa666d42ba1f7f9502
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                manifest.json
                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1952506178\manifest.json
                                                                                • Size 135B
                                                                                • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                manifest.json
                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2050609866\manifest.json
                                                                                • Size 69B
                                                                                • SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                hyph-as.hyb
                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2098933656\hyph-as.hyb
                                                                                • Size 703B
                                                                                • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                hyph-hi.hyb
                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2098933656\hyph-hi.hyb
                                                                                • Size 687B
                                                                                • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                hyph-nb.hyb
                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2098933656\hyph-nb.hyb
                                                                                • Size 141KB
                                                                                • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                manifest.json
                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2098933656\manifest.json
                                                                                • Size 82B
                                                                                • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                manifest.json
                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_550827369\manifest.json
                                                                                • Size 76B
                                                                                • SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                manifest.json
                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_629388173\manifest.json
                                                                                • Size 116B
                                                                                • SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                manifest.json
                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_671551153\manifest.json
                                                                                • Size 43B
                                                                                • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                manifest.json
                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_864771604\manifest.json
                                                                                • Size 1005B
                                                                                • SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                manifest.json
                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_908781578\manifest.json
                                                                                • Size 118B
                                                                                • SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                memory/2296-2240-0x00000218084D0000-0x00000218084FF000-memory.dmp
                                                                                Download

                                                                                memory/2572-458-0x00007FFD7ACA0000-0x00007FFD7ACA1000-memory.dmp
                                                                                Download

                                                                                memory/3304-2360-0x00007FFD734D0000-0x00007FFD735F6000-memory.dmp
                                                                                Download

                                                                                memory/3304-2359-0x00007FFD7BC00000-0x00007FFD7BC74000-memory.dmp
                                                                                Download

                                                                                memory/3304-2361-0x00007FFD78510000-0x00007FFD78578000-memory.dmp
                                                                                Download

                                                                                memory/3304-2354-0x00007FFD7ABD0000-0x00007FFD7AC97000-memory.dmp
                                                                                Download

                                                                                memory/3304-2358-0x00007FFD76F10000-0x00007FFD7773A000-memory.dmp
                                                                                Download

                                                                                memory/3304-2357-0x00007FFD782B0000-0x00007FFD782F8000-memory.dmp
                                                                                Download

                                                                                memory/3304-2355-0x00007FFD79870000-0x00007FFD79C11000-memory.dmp
                                                                                Download

                                                                                memory/3304-2356-0x00007FFD66080000-0x00007FFD66303000-memory.dmp
                                                                                Download

                                                                                memory/3600-2390-0x00007FFD78510000-0x00007FFD78578000-memory.dmp
                                                                                Download

                                                                                memory/3600-2385-0x00007FFD79870000-0x00007FFD79C11000-memory.dmp
                                                                                Download

                                                                                memory/3600-2384-0x00007FFD7ABD0000-0x00007FFD7AC97000-memory.dmp
                                                                                Download

                                                                                memory/3600-2386-0x00007FFD7B4A0000-0x00007FFD7BB96000-memory.dmp
                                                                                Download

                                                                                memory/3600-2388-0x00007FFD7BC00000-0x00007FFD7BC74000-memory.dmp
                                                                                Download

                                                                                memory/3600-2389-0x00007FFD66080000-0x00007FFD66303000-memory.dmp
                                                                                Download

                                                                                memory/3600-2387-0x00007FFD734D0000-0x00007FFD735F6000-memory.dmp
                                                                                Download

                                                                                memory/3736-443-0x00007FFD7ACA0000-0x00007FFD7ACA1000-memory.dmp
                                                                                Download

                                                                                memory/4628-144-0x0000017DF1F90000-0x0000017DF1FB2000-memory.dmp
                                                                                Download

                                                                                memory/4628-148-0x0000017DF2330000-0x0000017DF234E000-memory.dmp
                                                                                Download

                                                                                memory/4628-149-0x0000017DF2350000-0x0000017DF2402000-memory.dmp
                                                                                Download

                                                                                memory/4628-150-0x0000017DF2320000-0x0000017DF232A000-memory.dmp
                                                                                Download

                                                                                memory/4628-151-0x0000017DF2680000-0x0000017DF269E000-memory.dmp
                                                                                Download

                                                                                memory/4688-2445-0x00007FFD734D0000-0x00007FFD735F6000-memory.dmp
                                                                                Download

                                                                                memory/4688-2376-0x00007FFD782B0000-0x00007FFD782F8000-memory.dmp
                                                                                Download

                                                                                memory/4688-2375-0x00007FFD78510000-0x00007FFD78578000-memory.dmp
                                                                                Download

                                                                                memory/4688-2373-0x00007FFD734D0000-0x00007FFD735F6000-memory.dmp
                                                                                Download

                                                                                memory/4688-2377-0x00007FFD66080000-0x00007FFD66303000-memory.dmp
                                                                                Download

                                                                                memory/4688-2372-0x00007FFD7B4A0000-0x00007FFD7BB96000-memory.dmp
                                                                                Download

                                                                                memory/4688-2370-0x00007FFD7ABD0000-0x00007FFD7AC97000-memory.dmp
                                                                                Download

                                                                                memory/4688-2374-0x00007FFD7BC00000-0x00007FFD7BC74000-memory.dmp
                                                                                Download

                                                                                memory/4688-2371-0x00007FFD79870000-0x00007FFD79C11000-memory.dmp
                                                                                Download

                                                                                memory/4688-2396-0x00007FFD734D0000-0x00007FFD735F6000-memory.dmp
                                                                                Download

                                                                                memory/6200-838-0x00007FFD7BC00000-0x00007FFD7BC74000-memory.dmp
                                                                                Download

                                                                                memory/6200-842-0x00007FFD734D0000-0x00007FFD735F6000-memory.dmp
                                                                                Download

                                                                                memory/6200-836-0x00007FFD79870000-0x00007FFD79C11000-memory.dmp
                                                                                Download

                                                                                memory/6200-839-0x00007FFD66080000-0x00007FFD66303000-memory.dmp
                                                                                Download

                                                                                memory/6200-835-0x00007FFD7ABD0000-0x00007FFD7AC97000-memory.dmp
                                                                                Download

                                                                                memory/6200-844-0x00007FFD7B4A0000-0x00007FFD7BB96000-memory.dmp
                                                                                Download

                                                                                memory/6200-840-0x00007FFD78510000-0x00007FFD78578000-memory.dmp
                                                                                Download

                                                                                memory/6200-843-0x00007FFD782B0000-0x00007FFD782F8000-memory.dmp
                                                                                Download

                                                                                memory/6268-2231-0x000001FF69780000-0x000001FF697AF000-memory.dmp
                                                                                Download

                                                                                memory/6616-2228-0x00000207FE600000-0x00000207FE62F000-memory.dmp
                                                                                Download

                                                                                memory/6688-2239-0x000001D8E4710000-0x000001D8E473F000-memory.dmp
                                                                                Download

                                                                                memory/6976-2305-0x00000266860B0000-0x00000266860DF000-memory.dmp
                                                                                Download

                                                                                memory/7088-2243-0x000001BB29680000-0x000001BB296AF000-memory.dmp
                                                                                Download

                                                                                memory/7096-2247-0x0000027516500000-0x000002751652F000-memory.dmp
                                                                                Download

                                                                                memory/7104-2244-0x0000025015BE0000-0x0000025015C0F000-memory.dmp
                                                                                Download

                                                                                memory/7112-2232-0x000001B592D10000-0x000001B592D3F000-memory.dmp
                                                                                Download

                                                                                memory/7112-930-0x00007FFD7A380000-0x00007FFD7A381000-memory.dmp
                                                                                Download

                                                                                memory/7112-932-0x00007FFD7B2A0000-0x00007FFD7B2A1000-memory.dmp
                                                                                Download

                                                                                memory/7120-2245-0x0000020DA97A0000-0x0000020DA97CF000-memory.dmp
                                                                                Download

                                                                                memory/7128-2246-0x0000016E3E570000-0x0000016E3E59F000-memory.dmp
                                                                                Download

                                                                                memory/7584-2234-0x0000018A6AC10000-0x0000018A6AC3F000-memory.dmp
                                                                                Download

                                                                                memory/7840-2599-0x00000000066A0000-0x00000000066A8000-memory.dmp
                                                                                Download

                                                                                memory/7840-2600-0x00000000066B0000-0x00000000066B6000-memory.dmp
                                                                                Download

                                                                                memory/7840-2579-0x0000000005520000-0x0000000005B6A000-memory.dmp
                                                                                Download

                                                                                memory/7840-2580-0x00000000053E0000-0x0000000005402000-memory.dmp
                                                                                Download

                                                                                memory/7840-2581-0x0000000005480000-0x00000000054E6000-memory.dmp
                                                                                Download

                                                                                memory/7840-2582-0x0000000005B70000-0x0000000005BD6000-memory.dmp
                                                                                Download

                                                                                memory/7840-2583-0x0000000005BE0000-0x0000000005F3B000-memory.dmp
                                                                                Download

                                                                                memory/7840-2586-0x00000000060D0000-0x00000000060EE000-memory.dmp
                                                                                Download

                                                                                memory/7840-2587-0x00000000060F0000-0x000000000613C000-memory.dmp
                                                                                Download

                                                                                memory/7840-2588-0x00000000072F0000-0x0000000007326000-memory.dmp
                                                                                Download

                                                                                memory/7840-2589-0x000000006ECC0000-0x000000006ED0C000-memory.dmp
                                                                                Download

                                                                                memory/7840-2592-0x00000000066A0000-0x00000000066C0000-memory.dmp
                                                                                Download

                                                                                memory/7840-2593-0x0000000007330000-0x00000000073D3000-memory.dmp
                                                                                Download

                                                                                memory/7840-2594-0x0000000007A90000-0x000000000810C000-memory.dmp
                                                                                Download

                                                                                memory/7840-2595-0x0000000007450000-0x000000000746A000-memory.dmp
                                                                                Download

                                                                                memory/7840-2596-0x0000000007810000-0x0000000007A14000-memory.dmp
                                                                                Download

                                                                                memory/7840-2597-0x0000000007670000-0x000000000768A000-memory.dmp
                                                                                Download

                                                                                memory/7840-2598-0x0000000007720000-0x000000000774A000-memory.dmp
                                                                                Download

                                                                                memory/7840-2603-0x0000000007750000-0x0000000007776000-memory.dmp
                                                                                Download

                                                                                memory/7840-2578-0x0000000002DD0000-0x0000000002E06000-memory.dmp
                                                                                Download

                                                                                memory/7840-2601-0x00000000076A0000-0x00000000076AA000-memory.dmp
                                                                                Download

                                                                                memory/7840-2602-0x00000000076E0000-0x00000000076E8000-memory.dmp
                                                                                Download

                                                                                memory/7900-2557-0x000001E656310000-0x000001E656311000-memory.dmp
                                                                                Download

                                                                                memory/7900-2555-0x000001E656310000-0x000001E656311000-memory.dmp
                                                                                Download

                                                                                memory/7900-2561-0x000001E656310000-0x000001E656311000-memory.dmp
                                                                                Download

                                                                                memory/7984-2237-0x000001C24FAB0000-0x000001C24FADF000-memory.dmp
                                                                                Download

                                                                                memory/8260-2241-0x000001F40FAC0000-0x000001F40FAEF000-memory.dmp
                                                                                Download

                                                                                memory/8292-2230-0x0000023358F50000-0x0000023358F7F000-memory.dmp
                                                                                Download

                                                                                memory/8396-2242-0x000002A8EA780000-0x000002A8EA7AF000-memory.dmp
                                                                                Download

                                                                                memory/8492-2473-0x000002525DD30000-0x000002525DD5F000-memory.dmp
                                                                                Download

                                                                                memory/8492-2461-0x00007FFD7B2A0000-0x00007FFD7B2A1000-memory.dmp
                                                                                Download

                                                                                memory/8492-2462-0x00007FFD7A380000-0x00007FFD7A381000-memory.dmp
                                                                                Download

                                                                                memory/8952-2229-0x00000261929A0000-0x00000261929CF000-memory.dmp
                                                                                Download

                                                                                memory/9140-2238-0x00000203793E0000-0x000002037940F000-memory.dmp
                                                                                Download

                                                                                memory/9152-2236-0x0000027177300000-0x000002717732F000-memory.dmp
                                                                                Download

                                                                                memory/9160-2233-0x000001D133C60000-0x000001D133C8F000-memory.dmp
                                                                                Download

                                                                                memory/9196-2235-0x000002525E280000-0x000002525E2AF000-memory.dmp
                                                                                Download