Overview

overview

6

Static

static

1

Tomodachi ...M8.exe

windows10-ltsc_2021-x64

6

Tomodachi ...M8.exe

windows10-2004-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    21/04/2026, 01:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Tomodachi Life_0t-3QM8.exe
  • Size 13.8MB
  • Sample260421-b9dmesax4x
  • SHA256 888bfc44c03e97875fd1e88f56c8c052c94af130803a096114a76e480313f0dc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwaredefense_evasiondiscoveryinstallerpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Downloads MZ/PE file 3 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 7 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 22 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • NSIS installer 2 IoCs
    installer
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 56 IoCs
  • Modifies system certificate store 2 TTPs 19 IoCs
    defense_evasionspywaretrojan
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Tomodachi Life_0t-3QM8.exe
    "C:\Users\Admin\AppData\Local\Temp\Tomodachi Life_0t-3QM8.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4652
    • C:\Users\Admin\AppData\Local\Temp\is-61HDI.tmp\Tomodachi Life_0t-3QM8.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-61HDI.tmp\Tomodachi Life_0t-3QM8.tmp" /SL5="$6033A,13603942,780800,C:\Users\Admin\AppData\Local\Temp\Tomodachi Life_0t-3QM8.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4696
      • C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\prod0_extract\saBSI.exe
        "C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\prod0_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB InstallID=GnjW1dee96lcG14KC94guW4NNtHImLgWsJaZ6FoXKUY8gFVKsAwa1GDqXTOWtJR9ytVElygYeZkflwD6P2p
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2472
        • C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
          "C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91082 PaidDistribution=true InstallID=GnjW1dee96lcG14KC94guW4NNtHImLgWsJaZ6FoXKUY8gFVKsAwa1GDqXTOWtJR9ytVElygYeZkflwD6P2p saBsiVersion=4.1.1.865 CountryCode=GB /no_self_update
          4⤵
          • Downloads MZ/PE file
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5336
          • C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe
            "C:\ProgramData\McAfee\WebAdvisor\saBSI\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
            5⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2352
            • C:\Program Files\McAfee\Temp1854146836\installer.exe
              "C:\Program Files\McAfee\Temp1854146836\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
              6⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:4672
      • C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\prod1_extract\WZSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\prod1_extract\WZSetup.exe" /S /tpchannelid=1571 /distid=App123
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2060
        • C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe
          "C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe" install
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5836
        • C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe
          "C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe" start silent
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6760
      • C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\prod2_extract\OperaGXSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\prod2_extract\OperaGXSetup.exe" --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:operagx,utm.id:BjYV7wRV0DDH7CDCpyEw82Otwp0bD3zmRwrh3UZ14jhUW38fv1SVAblC88uAB67Fy5As6CQH4bhzi49
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2416
        • C:\Users\Admin\AppData\Local\Temp\7zS079E7D49\setup.exe
          C:\Users\Admin\AppData\Local\Temp\7zS079E7D49\setup.exe --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:operagx,utm.id:BjYV7wRV0DDH7CDCpyEw82Otwp0bD3zmRwrh3UZ14jhUW38fv1SVAblC88uAB67Fy5As6CQH4bhzi49 --server-tracking-blob=ZTlkNzM2OWE0ZmQ4NmRjMzMxY2ZkYzc3NDNiOGNjOWVlYzY4NTQ1ZWE3ZGI3MGQ3M2VjZjg1N2MzNmRmNjI5ZDp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yIiwidGltZXN0YW1wIjoiMTc1Nzg0NzYzNS4zNjE1IiwidXNlcmFnZW50IjoicHl0aG9uLXJlcXVlc3RzLzIuMzIuMyIsInV0bSI6e30sInV1aWQiOiIyYjBlYWY3NC00NGQ4LTQ2NjktYWNiZC1lYzUzNmZmMzhhYzYifQ==
          4⤵
          • Downloads MZ/PE file
          • Enumerates connected drives
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious use of WriteProcessMemory
          PID:2628
          • C:\Users\Admin\AppData\Local\Temp\7zS079E7D49\setup.exe
            C:\Users\Admin\AppData\Local\Temp\7zS079E7D49\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=121.0.5600.81 --initial-client-data=0x268,0x26c,0x270,0x264,0x274,0x7ffc9c7a8ef0,0x7ffc9c7a8efc,0x7ffc9c7a8f08
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1728
          • C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\setup.exe
            "C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\setup.exe" --version
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:740
          • C:\Users\Admin\AppData\Local\Temp\7zS079E7D49\setup.exe
            "C:\Users\Admin\AppData\Local\Temp\7zS079E7D49\setup.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2628 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\opera_package_20260421025140" --session-guid=0956e166-099f-4d46-9e5f-e20088987575 --server-tracking-blob="ODgxMWM1YzEwMmJmZTBiNTlhYTIzMWVmYTdmODExOWIyYzkzMWY4MGJiZjg0MGI5MjNmNDg1MmRjMjEyOTdjMzp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzU3ODQ3NjM1LjM2MTUiLCJ1c2VyYWdlbnQiOiJweXRob24tcmVxdWVzdHMvMi4zMi4zIiwidXRtIjp7ImNhbXBhaWduIjoib3BlcmFneCIsImlkIjoiQmpZVjd3UlYwRERIN0NEQ3B5RXc4Mk90d3AwYkQzem1Sd3JoM1VaMTRqaFVXMzhmdjFTVkFibEM4OHVBQjY3Rnk1QXM2Q1FINGJoemk0OSIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6ImFpcyJ9LCJ1dWlkIjoiMmIwZWFmNzQtNDRkOC00NjY5LWFjYmQtZWM1MzZmZjM4YWM2In0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=2807000000000000
            5⤵
            • Enumerates connected drives
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:5944
            • C:\Users\Admin\AppData\Local\Temp\7zS079E7D49\setup.exe
              C:\Users\Admin\AppData\Local\Temp\7zS079E7D49\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=121.0.5600.81 --initial-client-data=0x260,0x264,0x274,0x23c,0x278,0x7ffc9b698ef0,0x7ffc9b698efc,0x7ffc9b698f08
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:5952
            • C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\installer.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\installer.exe" --backend --initial-pid=2628 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\opera_package_202604210251401" --session-guid=0956e166-099f-4d46-9e5f-e20088987575 --server-tracking-blob="ODgxMWM1YzEwMmJmZTBiNTlhYTIzMWVmYTdmODExOWIyYzkzMWY4MGJiZjg0MGI5MjNmNDg1MmRjMjEyOTdjMzp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzU3ODQ3NjM1LjM2MTUiLCJ1c2VyYWdlbnQiOiJweXRob24tcmVxdWVzdHMvMi4zMi4zIiwidXRtIjp7ImNhbXBhaWduIjoib3BlcmFneCIsImlkIjoiQmpZVjd3UlYwRERIN0NEQ3B5RXc4Mk90d3AwYkQzem1Sd3JoM1VaMTRqaFVXMzhmdjFTVkFibEM4OHVBQjY3Rnk1QXM2Q1FINGJoemk0OSIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6ImFpcyJ9LCJ1dWlkIjoiMmIwZWFmNzQtNDRkOC00NjY5LWFjYmQtZWM1MzZmZjM4YWM2In0= " --silent --desktopshortcut=1 --install-subfolder=130.0.5847.58
              6⤵
              • Enumerates connected drives
              • Executes dropped EXE
              • Enumerates system info in registry
              • Modifies registry class
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:6748
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\installer.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x278,0x274,0x27c,0x24c,0x280,0x7ff6cba0e6d8,0x7ff6cba0e6e4,0x7ff6cba0e6f0
                7⤵
                • Executes dropped EXE
                PID:6756
              • C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\opera_package_202604210251401\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\opera_package_202604210251401\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --copyonly=0 --allusers=0
                7⤵
                • Adds Run key to start application
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Enumerates system info in registry
                • Modifies Internet Explorer settings
                • Suspicious use of WriteProcessMemory
                PID:4468
                • C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\opera_package_202604210251401\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\opera_package_202604210251401\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x1164040,0x116404c,0x1164058
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:4784
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --run-assistant --allusers=0
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Enumerates system info in registry
                  • Suspicious use of WriteProcessMemory
                  PID:5676
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0xd54040,0xd5404c,0xd54058
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:6272
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe"
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Enumerates system info in registry
                    • Suspicious use of WriteProcessMemory
                    PID:6324
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:1808
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\opera_crashreporter.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x174,0x178,0x170,0x140,0x16c,0x7ffc9532c540,0x7ffc9532c550,0x7ffc9532c560
                        11⤵
                        • Executes dropped EXE
                        PID:1916
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of WriteProcessMemory
                      PID:5900
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\opera_crashreporter.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x194,0x198,0x190,0x160,0x18c,0x7ffc9532c540,0x7ffc9532c550,0x7ffc9532c560
                        11⤵
                        • Executes dropped EXE
                        PID:2516
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x260,0x264,0x268,0x240,0x26c,0x152d830,0x152d83c,0x152d848
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4756
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Enumerates system info in registry
                        • Suspicious use of WriteProcessMemory
                        PID:892
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\opera_crashreporter.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x144,0x178,0x17c,0x148,0x174,0x7ffc9532c540,0x7ffc9532c550,0x7ffc9532c560
                          12⤵
                          • Executes dropped EXE
                          PID:6412
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of WriteProcessMemory
                        PID:216
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\opera_crashreporter.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x174,0x178,0x170,0x140,0x16c,0x7ffc9532c540,0x7ffc9532c550,0x7ffc9532c560
                          12⤵
                          • Executes dropped EXE
                          PID:6676
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Enumerates system info in registry
                        • Suspicious use of WriteProcessMemory
                        PID:6496
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\opera_crashreporter.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x174,0x178,0x170,0x140,0x16c,0x7ffc9532c540,0x7ffc9532c550,0x7ffc9532c560
                          12⤵
                          • Executes dropped EXE
                          PID:4604
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
                7⤵
                • Adds Run key to start application
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:2520
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\opera_crashreporter.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x17c,0x180,0x178,0x148,0x174,0x7ffc9532c540,0x7ffc9532c550,0x7ffc9532c560
                  8⤵
                  • Executes dropped EXE
                  PID:1012
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,1567042911496292503,17474217513060518433,262144 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1884 /prefetch:2
                  8⤵
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  PID:2556
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=1912,i,3922343013228913302,6420485882017787542,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1944 /prefetch:3
                  8⤵
                  • Executes dropped EXE
                  • System Time Discovery
                  • Enumerates system info in registry
                  PID:8
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=2304,i,14231566713629752822,392833208438602336,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2512 /prefetch:8
                  8⤵
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  PID:4456
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=2608,i,14685527258411686058,13434624493972900152,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2740 /prefetch:8
                  8⤵
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  PID:5832
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=2684,i,1555139919568428948,14176138060340432018,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=2800 /prefetch:8
                  8⤵
                  • Executes dropped EXE
                  PID:5612
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=2660,i,13816814793285231123,14526991641566468705,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2760 /prefetch:8
                  8⤵
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  PID:4112
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=2708,i,1692803451239616201,242201283011385639,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=2840 /prefetch:8
                  8⤵
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  PID:6024
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=2696,i,17623077919953547062,14993138467012083206,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=2820 /prefetch:8
                  8⤵
                  • Executes dropped EXE
                  PID:3764
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=2672,i,3404450807216059590,5757060789438154508,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=2780 /prefetch:8
                  8⤵
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  PID:1816
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=2968,i,7455654512216314091,9211217760160266677,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=2972 /prefetch:1
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  PID:1248
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\opera_gx_splash.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\opera_gx_splash.exe" --instance-name=61C8973803226C4D4008DEBC18682105EDAB1556896BB924D0EEB1B6C96AB147
                  8⤵
                  • Executes dropped EXE
                  PID:3908
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4580,i,13609457823163084366,8219357754533916440,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4600 /prefetch:1
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  PID:4912
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4776,i,16208129511014628745,8590796947024835726,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4784 /prefetch:2
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  PID:6984
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4944,i,18402357586172404445,10844983191131974007,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4956 /prefetch:1
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  PID:6816
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5172,i,9369419445155398777,13392955146973144518,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5184 /prefetch:1
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  PID:7076
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --asus-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=5300,i,18109186256036255613,7823530245115599833,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5320 /prefetch:8
                  8⤵
                  • Executes dropped EXE
                  PID:4576
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --corsair-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=5296,i,940018083438914280,12730168086654072644,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5392 /prefetch:8
                  8⤵
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  PID:7100
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --logitech-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=5308,i,9409963948996249670,6676279846870761316,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5400 /prefetch:8
                  8⤵
                  • Executes dropped EXE
                  PID:7156
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --razer-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=5312,i,5900021311336688579,12109684118209652886,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5412 /prefetch:8
                  8⤵
                  • Executes dropped EXE
                  PID:3852
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5988,i,16488118471184772989,5004153269748291489,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6312 /prefetch:2
                  8⤵
                  • Checks computer location settings
                  PID:4368
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6676,i,4321944372683305122,5187719987363213014,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6700 /prefetch:2
                  8⤵
                  • Checks computer location settings
                  • Enumerates system info in registry
                  PID:1428
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6744,i,8973831294664971050,201986657493043796,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6968 /prefetch:2
                  8⤵
                  • Checks computer location settings
                  PID:2328
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7100,i,17257283550591734466,6849046677637928137,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7104 /prefetch:1
                  8⤵
                  • Checks computer location settings
                  • Enumerates system info in registry
                  PID:7584
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7300,i,17835657713061163837,15169170256048813252,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7304 /prefetch:2
                  8⤵
                  • Checks computer location settings
                  PID:7608
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=7344,i,18090038909742965001,18107172804509695017,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=7456 /prefetch:1
                  8⤵
                  • Checks computer location settings
                  • Enumerates system info in registry
                  PID:8120
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7556,i,13014373873142362018,11373848100705444206,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7592 /prefetch:1
                  8⤵
                  • Checks computer location settings
                  • Enumerates system info in registry
                  PID:1400
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=7704,i,13572908558488364572,13463505435431881716,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7568 /prefetch:8
                  8⤵
                  • Enumerates system info in registry
                  PID:5956
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=7964,i,13578752738909813974,17353188983253494855,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=7948 /prefetch:8
                  8⤵
                  • Enumerates system info in registry
                  PID:6888
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=7956,i,11607864420384183593,16914702315360510611,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=7940 /prefetch:8
                  8⤵
                    PID:6880
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=8008,i,14445640073135779822,6060891472810527971,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8072 /prefetch:8
                    8⤵
                    • Enumerates system info in registry
                    PID:4452
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=7988,i,11207486852211031094,2293980602482197791,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8032 /prefetch:8
                    8⤵
                    • Enumerates system info in registry
                    PID:7176
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=8000,i,17381779146574883058,7525112390879172112,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8052 /prefetch:8
                    8⤵
                      PID:7184
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=8020,i,11267656973282695872,13927865129593992705,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8044 /prefetch:8
                      8⤵
                      • Enumerates system info in registry
                      PID:7200
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=9240,i,9577325257674380753,14572182062190611525,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9244 /prefetch:8
                      8⤵
                        PID:7428
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=9400,i,14247661363430998781,12185458621762538361,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9444 /prefetch:2
                        8⤵
                        • Checks computer location settings
                        PID:7440
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=9580,i,8685960846035791437,3389821559059543401,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=9600 /prefetch:8
                        8⤵
                        • Enumerates system info in registry
                        PID:7456
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=9456,i,13115167353127935062,18205709332866924778,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=9620 /prefetch:8
                        8⤵
                        • Enumerates system info in registry
                        PID:7464
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=9472,i,14847078280756070925,4848185572082003806,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=9640 /prefetch:8
                        8⤵
                        • Enumerates system info in registry
                        PID:7472
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=9624,i,233643605617809479,13540711245369900875,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10024 /prefetch:8
                        8⤵
                        • Enumerates system info in registry
                        PID:7692
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=10164,i,12873387945803829174,15941073753401310689,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10180 /prefetch:8
                        8⤵
                        • Enumerates system info in registry
                        PID:7672
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=10332,i,6151279769481748647,5415940046766949722,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10336 /prefetch:8
                        8⤵
                        • Enumerates system info in registry
                        PID:3032
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --pipeid=oauc_pipeF347B60CA73F3F3DA84B31019F4EB851ECFC332513021FC062CC0CA8D8440B54
                        8⤵
                        • Enumerates system info in registry
                        PID:7372
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x7ff755a1d738,0x7ff755a1d744,0x7ff755a1d750
                          9⤵
                            PID:7508
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=10708,i,12530518521037706043,15853802109182822013,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=10688 /prefetch:1
                          8⤵
                          • Checks computer location settings
                          • Enumerates system info in registry
                          PID:8288
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.side_profiles.mojom.SideProfilesHandler --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=10872,i,3841160905419359665,6128485730855484746,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=10876 /prefetch:8
                          8⤵
                            PID:8988
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\installer.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\installer.exe" --fix-taskbar-pins
                            8⤵
                              PID:5760
                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\installer.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff6cba0e6d8,0x7ff6cba0e6e4,0x7ff6cba0e6f0
                                9⤵
                                  PID:7228
                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=10924,i,9735100926753728247,18343048478742533771,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=10912 /prefetch:8
                                8⤵
                                • Enumerates system info in registry
                                PID:2900
                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=11064,i,6729217836869924502,10773997427038896260,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=11056 /prefetch:8
                                8⤵
                                • Enumerates system info in registry
                                PID:8444
                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=9772,i,18168266593446353270,10268817197949636110,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=10012 /prefetch:8
                                8⤵
                                  PID:7808
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=6440,i,3432135821174486177,3038150433720562169,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=11044 /prefetch:8
                                  8⤵
                                  • Enumerates system info in registry
                                  PID:7732
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=6364,i,8470535172582157281,4297796661539728579,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=5404 /prefetch:8
                                  8⤵
                                  • Enumerates system info in registry
                                  PID:7212
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=6740,i,1663861638827021374,10135242356182339961,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=10916 /prefetch:2
                                  8⤵
                                  • Checks computer location settings
                                  • Enumerates system info in registry
                                  PID:3792
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=5312,i,14219077722557502358,6215869520156476083,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=3900 /prefetch:8
                                  8⤵
                                  • Enumerates system info in registry
                                  PID:2388
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=11032,i,10253524528186630714,17173246075709260399,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=11020 /prefetch:8
                                  8⤵
                                  • Enumerates system info in registry
                                  PID:8368
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=11044,i,4996364466282673678,2341511953507042592,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=6568 /prefetch:8
                                  8⤵
                                  • Enumerates system info in registry
                                  PID:9096
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=7884,i,14711145404637536626,18444999719698702509,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=10192 /prefetch:8
                                  8⤵
                                    PID:6888
                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=9684,i,16728548947578893239,1459236539331424278,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=9668 /prefetch:8
                                    8⤵
                                      PID:9212
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=8640,i,2315206340033954194,7854425706804645165,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=8748 /prefetch:8
                                      8⤵
                                      • Enumerates system info in registry
                                      PID:7028
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=8736,i,12350262955353544271,14407498575285739148,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=8324 /prefetch:8
                                      8⤵
                                      • Enumerates system info in registry
                                      PID:7212
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=11060,i,12835158279885203923,7058789036674824312,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=10484 /prefetch:2
                                      8⤵
                                      • Checks computer location settings
                                      • Enumerates system info in registry
                                      PID:7128
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=8324,i,1275354397248010709,14227295614762197059,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=9888 /prefetch:2
                                      8⤵
                                      • Checks computer location settings
                                      • Enumerates system info in registry
                                      PID:4280
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --metrics-shmem-handle=9732,i,17089833616693165795,4385973798612028651,524288 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=6392 /prefetch:8
                                      8⤵
                                      • Enumerates system info in registry
                                      PID:9064
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=9324,i,14122038905308613527,1245128006228732237,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709045345507981 --mojo-platform-channel-handle=9272 /prefetch:2
                                      8⤵
                                      • Checks computer location settings
                                      PID:3296
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 OPR/130.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:gx-post-mortem=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest10-ref:DNA-99214_GXCTest10 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=8520,i,14847060104159474569,2174400240302060133,2097152 --field-trial-handle=1888,i,12590721925777677395,14064792439860693866,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1892,i,2732785801475955849,4234144358283449182,4 --trace-process-track-uuid=3190709046282549830 --mojo-platform-channel-handle=9376 /prefetch:1
                                      8⤵
                                      • Checks computer location settings
                                      PID:416
                              • C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\opera_package_202604210251401\assistant\Opera_GX_assistant_130.0.5847.58_Setup.exe_sfx.exe
                                "C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\opera_package_202604210251401\assistant\Opera_GX_assistant_130.0.5847.58_Setup.exe_sfx.exe"
                                5⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:6852
                              • C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\opera_package_202604210251401\assistant\assistant_installer.exe
                                "C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\opera_package_202604210251401\assistant\assistant_installer.exe" --version
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Enumerates system info in registry
                                • Suspicious use of WriteProcessMemory
                                PID:6924
                                • C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\opera_package_202604210251401\assistant\assistant_installer.exe
                                  "C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\opera_package_202604210251401\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x224,0x228,0x22c,0x220,0x230,0x1164040,0x116404c,0x1164058
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  PID:6940
                          • C:\Windows\SysWOW64\netsh.exe
                            "netsh" firewall add allowedprogramC:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\qbittorrent.exe "qBittorrent" ENABLE
                            3⤵
                            • Modifies Windows Firewall
                            • Event Triggered Execution: Netsh Helper DLL
                            • System Location Discovery: System Language Discovery
                            PID:4140
                          • C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\qbittorrent.exe
                            "C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\qbittorrent.exe" magnet:?xt=urn:btih:BFF18AF5608F9196CF05BF0C1F0B54A18C3F0A77
                            3⤵
                            • Enumerates connected drives
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious behavior: GetForegroundWindowSpam
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            PID:3352
                      • C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
                        "C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
                        1⤵
                        • Drops file in Program Files directory
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Modifies data under HKEY_USERS
                        • Modifies system certificate store
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:384
                        • C:\Program Files\McAfee\WebAdvisor\UIHost.exe
                          "C:\Program Files\McAfee\WebAdvisor\UIHost.exe"
                          2⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:3964
                        • C:\Program Files\McAfee\WebAdvisor\updater.exe
                          "C:\Program Files\McAfee\WebAdvisor\updater.exe"
                          2⤵
                          • Executes dropped EXE
                          • Modifies data under HKEY_USERS
                          • Suspicious use of WriteProcessMemory
                          PID:6220
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c IF EXIST "C:\Program Files\McAfee\WebAdvisor\Download" ( DEL "C:\Program Files\McAfee\WebAdvisor\Download\*.bak" )
                            3⤵
                              PID:6804
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c DEL "C:\Program Files\McAfee\WebAdvisor\*.tmp"
                              3⤵
                                PID:6996
                          • C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe
                            "C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe"
                            1⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:4844
                            • C:\Program Files (x86)\WeatherZero\WeatherZero.exe
                              "C:\Program Files (x86)\WeatherZero\WeatherZero.exe" /q=54FB22B5624002425A0AD4CE8D5162B0
                              2⤵
                              • Drops desktop.ini file(s)
                              • Drops file in Windows directory
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Modifies system certificate store
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of WriteProcessMemory
                              PID:6044
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hy__wefw.cmdline"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:5800
                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES10AC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC10AB.tmp"
                                  4⤵
                                    PID:6440
                            • C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
                              C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
                              1⤵
                                PID:2708
                              • C:\Windows\system32\wbem\unsecapp.exe
                                C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                1⤵
                                  PID:5524
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  PID:4128
                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\opera_crashreporter.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x148,0x14c,0x154,0x144,0x150,0x7ffc9532c540,0x7ffc9532c550,0x7ffc9532c560
                                    2⤵
                                    • Executes dropped EXE
                                    PID:6140
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe7FAE56220944838BCDB933E86AD23A432FE91C0ADA84DF94778C72EE141B2B1F
                                  1⤵
                                    PID:7512
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x274,0x278,0x27c,0x210,0x280,0x7ff755a1d738,0x7ff755a1d744,0x7ff755a1d750
                                      2⤵
                                        PID:8896
                                      • C:\Users\Admin\AppData\Local\Temp\.opera\9B44A87EC5AC\installer.exe
                                        "C:\Users\Admin\AppData\Local\Temp\.opera\9B44A87EC5AC\installer.exe" --version
                                        2⤵
                                          PID:9120

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Reconnaissance

                                            Resource Development

                                            Initial Access

                                            Execution

                                            Persistence

                                            Boot or Logon Autostart Execution

                                            1
                                            T1547

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1547.001

                                            Create or Modify System Process

                                            1
                                            T1543

                                            Windows Service

                                            1
                                            T1543.003

                                            Event Triggered Execution

                                            2
                                            T1546

                                            Component Object Model Hijacking

                                            1
                                            T1546.015

                                            Netsh Helper DLL

                                            1
                                            T1546.007

                                            Privilege Escalation

                                            Boot or Logon Autostart Execution

                                            1
                                            T1547

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1547.001

                                            Create or Modify System Process

                                            1
                                            T1543

                                            Windows Service

                                            1
                                            T1543.003

                                            Event Triggered Execution

                                            2
                                            T1546

                                            Component Object Model Hijacking

                                            1
                                            T1546.015

                                            Netsh Helper DLL

                                            1
                                            T1546.007

                                            Defense Evasion

                                            Impair Defenses

                                            1
                                            T1562

                                            Disable or Modify System Firewall

                                            1
                                            T1562.004

                                            Modify Registry

                                            3
                                            T1112

                                            Subvert Trust Controls

                                            1
                                            T1553

                                            Install Root Certificate

                                            1
                                            T1553.004

                                            Credential Access

                                            Credentials from Password Stores

                                            1
                                            T1555

                                            Credentials from Web Browsers

                                            1
                                            T1555.003

                                            Unsecured Credentials

                                            1
                                            T1552

                                            Credentials In Files

                                            1
                                            T1552.001

                                            Discovery

                                            Peripheral Device Discovery

                                            1
                                            T1120

                                            Query Registry

                                            6
                                            T1012

                                            System Information Discovery

                                            5
                                            T1082

                                            System Location Discovery

                                            1
                                            T1614

                                            System Language Discovery

                                            1
                                            T1614.001

                                            System Time Discovery

                                            1
                                            T1124

                                            Lateral Movement

                                            Collection

                                            Data from Local System

                                            1
                                            T1005

                                            Command and Control

                                            Exfiltration

                                            Impact

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            WeatherZeroService.exe
                                            • Path C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe
                                            • Size 3.2MB
                                            • SHA256 95f0e021c978ddd88e2218a7467579255a5ae9552af2508c4243a4adec52d2b8
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            analyticsmanager.cab
                                            • Path C:\Program Files\McAfee\Temp1854146836\analyticsmanager.cab
                                            • Size 2.4MB
                                            • SHA256 a04e93af8975ba804a776a8dfe0553d3ea3f8acd39bb44df285a2a7b39e91b17
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            analyticstelemetry.cab
                                            • Path C:\Program Files\McAfee\Temp1854146836\analyticstelemetry.cab
                                            • Size 63KB
                                            • SHA256 2d9d34ab27ce1740117e24733cecd4eca2a46edee47209595b19ecd0313fa214
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            browserhost.cab
                                            • Path C:\Program Files\McAfee\Temp1854146836\browserhost.cab
                                            • Size 1.8MB
                                            • SHA256 63a9131e3be00e342c40febb90b15b8a07e7ed3097c443582fe594401b84e4fb
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            browserplugin.cab
                                            • Path C:\Program Files\McAfee\Temp1854146836\browserplugin.cab
                                            • Size 4.8MB
                                            • SHA256 586c01e17479bc3deb8873cd2da8946f81b6cec60d661d9eab8528a929a3f463
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ds_invoker.cab
                                            • Path C:\Program Files\McAfee\Temp1854146836\ds_invoker.cab
                                            • Size 3.4MB
                                            • SHA256 8d092c2f771df754873a0d1c85acc50d37899e57930fad721dd5da343366e034
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            installer.exe
                                            • Path C:\Program Files\McAfee\Temp1854146836\installer.exe
                                            • Size 3.0MB
                                            • SHA256 6c4949ff6f4aaffc7c31c2be0894a8df27f2f41c9c8019af15dc16f4917120b8
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            l10n.cab
                                            • Path C:\Program Files\McAfee\Temp1854146836\l10n.cab
                                            • Size 225KB
                                            • SHA256 9e08358247342b950397101734ae18fabbd8cd1ac487fb0795c567ebfb1addae
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            logicmodule.cab
                                            • Path C:\Program Files\McAfee\Temp1854146836\logicmodule.cab
                                            • Size 2.1MB
                                            • SHA256 cbeae62bde956d02f97d3ba0042ea79d65fc2423128835866eef2ca940dde35a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            logicscripts.cab
                                            • Path C:\Program Files\McAfee\Temp1854146836\logicscripts.cab
                                            • Size 67KB
                                            • SHA256 9d77660e2671645a7f84fdb680be85e86b712ead6e21d2ce19ccd368a92cc436
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            mfw-mwb.cab
                                            • Path C:\Program Files\McAfee\Temp1854146836\mfw-mwb.cab
                                            • Size 20KB
                                            • SHA256 422bc6675e807bca196f64a63d458b6c0bc8605cf66345f5ca07c04676c746a4
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            mfw-nps.cab
                                            • Path C:\Program Files\McAfee\Temp1854146836\mfw-nps.cab
                                            • Size 22KB
                                            • SHA256 e5703b92441a8fc977a58c68e94cf87df776525aae00d35af994f50f2a925d4a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            mfw-webadvisor.cab
                                            • Path C:\Program Files\McAfee\Temp1854146836\mfw-webadvisor.cab
                                            • Size 702KB
                                            • SHA256 94e8bd7535dea0278714bfe62cfb6f569e1574528c9e19d7d0d35e3daa420c63
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            mfw.cab
                                            • Path C:\Program Files\McAfee\Temp1854146836\mfw.cab
                                            • Size 782KB
                                            • SHA256 f859e8fa30d4c9f28adf9df2f896e8eac1f92b172a8e7cb3351fff439258dbad
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            resourcedll.cab
                                            • Path C:\Program Files\McAfee\Temp1854146836\resourcedll.cab
                                            • Size 37KB
                                            • SHA256 e664862a95e90ccebd7da1642209d7e235e9b2d32234ae7648e86c89d55965f0
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            servicehost.cab
                                            • Path C:\Program Files\McAfee\Temp1854146836\servicehost.cab
                                            • Size 341KB
                                            • SHA256 181d36d47a3a5ddcd632e0ed8e560554564f7f9b772292d03ac679b70ef218c7
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            settingmanager.cab
                                            • Path C:\Program Files\McAfee\Temp1854146836\settingmanager.cab
                                            • Size 815KB
                                            • SHA256 39e8029545023292a7926141c40217ea98616fdb8c03468d343d94e62601161c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            taskmanager.cab
                                            • Path C:\Program Files\McAfee\Temp1854146836\taskmanager.cab
                                            • Size 3.5MB
                                            • SHA256 37603cfcc56501ab71a3b03b4ba626f6796a69ec8c25a8ef558b8137df20620e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            uihost.cab
                                            • Path C:\Program Files\McAfee\Temp1854146836\uihost.cab
                                            • Size 336KB
                                            • SHA256 bbbe376b9798139d78d2777d601a64078dcedd7593bda21abe5076417fd2d37c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            uimanager.cab
                                            • Path C:\Program Files\McAfee\Temp1854146836\uimanager.cab
                                            • Size 4.2MB
                                            • SHA256 8d3ca6fab585db9a03a2219d1037ad4c92a39cd0f9f5675095758990931b58e6
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            dataConfig.cab
                                            • Path C:\Program Files\McAfee\WebAdvisor\Analytics\dataConfig.cab
                                            • Size 79KB
                                            • SHA256 25eb01addb5884c1aa13f6bf92b2b1ebfc1ad3d9326d27da8c34b1e2bcfa2101
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            log_00200057003F001D0006.txt
                                            • Path C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt
                                            • Size 958B
                                            • SHA256 f9be4b171aa688a5a01bdb5bc61864d46ca4845a5ea3da6784c408ac5169015d
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            log_00200057003F001D0006.txt
                                            • Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
                                            • Size 3KB
                                            • SHA256 37b558c0e0c8cdecf5956c8029a4537851cb36759af45cb81c017b0c158a29a7
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            log_00200057003F001D0006.txt
                                            • Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
                                            • Size 6KB
                                            • SHA256 d3202493f9c8dc5ab38da6427d27eec5a54480658f22d5b30f01e969f24e2291
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            log_00200057003F001D0006.txt
                                            • Path C:\ProgramData\McAfee\WebAdvisor\saBSI.exe\log_00200057003F001D0006.txt
                                            • Size 302B
                                            • SHA256 2340f4b68b27bdbec2ce3204f35739893669632fea9c7bc92abdaaa8ced48b23
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            installer.exe
                                            • Path C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe
                                            • Size 31.6MB
                                            • SHA256 fddfe31aa92bcb813926511e3cebc9f8746a1754f4b46cd7a9e9f251f7a8dc43
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            saBSI.exe
                                            • Path C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
                                            • Size 1.5MB
                                            • SHA256 5ec42b168f2541dbb413d6f87aa5569470a2b0c6c574c3e655242461a4524763
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            custom_partner_content.json
                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\130.0.5847.58\resources\custom_partner_content.json
                                            • Size 245KB
                                            • SHA256 84bc1efb211c6b45f2906278a36f1414922f994a9611bbee7713ffd4ae21e967
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            assistant_installer.exe
                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                                            • Size 2.5MB
                                            • SHA256 39284ef1695bee19a8fa544f64215eb9fa49dc97b05bca3499d0a2781055929c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            browser_assistant.exe
                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                                            • Size 5.2MB
                                            • SHA256 91455152ee199195352f4f42ef7000c08ac52b4b9149577b8cde0244b1c12c1b
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            installer_prefs.json
                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\installer_prefs.json
                                            • Size 1KB
                                            • SHA256 ada4c892bd46fdf95b2b9596223768592f34ca7e95039cebac71a25c6fc240d1
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            opera.exe
                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                            • Size 2.6MB
                                            • SHA256 3eb1a2f751e85be99426bad0cfa580ca19a608a7e121b2f1cb597f95a5347ea6
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Opera GX Browser.lnk
                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\opera_package_202604210251401\Opera GX Browser.lnk
                                            • Size 1KB
                                            • SHA256 debcb53f757c678dae456f039eb2c92d2379edcb687e4e427afcb858b75ab9f8
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            Opera_GX_assistant_130.0.5847.58_Setup.exe_sfx.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\opera_package_202604210251401\assistant\Opera_GX_assistant_130.0.5847.58_Setup.exe_sfx.exe
                                            • Size 2.8MB
                                            • SHA256 1ef33f3f50727d57dda98c03db5f759fc66315965fda144dbcbe41e3d0720265
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            installer_prefs_include.json
                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\opera_package_202604210251401\installer_prefs_include.json
                                            • Size 273B
                                            • SHA256 88c798ceb9ce965a8007d563b5287098999b91671da1d1514dc434235dd733db
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            installer_prefs_include.json
                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\opera_package_202604210251401\installer_prefs_include.json
                                            • Size 798B
                                            • SHA256 5d586f20e39e1b80be737a9fa02ca586b9a15b584ac204d201b410ff2fc2ceed
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            installer_prefs_include.json.backup
                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\69e8fc2e-b879-4450-8d78-316e7fbf01d6 Opera GX Installer Temp\opera_package_202604210251401\installer_prefs_include.json.backup
                                            • Size 258B
                                            • SHA256 2056f623f21135a4cf05638c6b9c2f207f2dc0c49c4d0fcfd01c59edc3e12627
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            setup.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\7zS079E7D49\setup.exe
                                            • Size 8.1MB
                                            • SHA256 8be09d18795860b08ce3ee4f21c05b3205fba0541ac174cfae1a66d19b21b8ea
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Opera_installer_2604210151394442628.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2604210151394442628.dll
                                            • Size 7.5MB
                                            • SHA256 7cac08fa3fc954671ddbeeae0a9c6c44b31b1e47ee8cf0591f6ce4f012fc0b02
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Tomodachi Life_0t-3QM8.tmp
                                            • Path C:\Users\Admin\AppData\Local\Temp\is-61HDI.tmp\Tomodachi Life_0t-3QM8.tmp
                                            • Size 2.9MB
                                            • SHA256 eaa483432e2cae37fcf1350c160b848948f8e512ed085fab67d901bfcd8d5d07
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            OperaGX.png
                                            • Path C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\OperaGX.png
                                            • Size 152KB
                                            • SHA256 2f116cdef55e05549d6f06913afe39a91b715b188e110188c7fbf7f5eb69b318
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            WeatherZero.png
                                            • Path C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\WeatherZero.png
                                            • Size 29KB
                                            • SHA256 ab99cdb7d798cb7b7d8517584d546aa4ed54eca1b808de6d076710c8a400c8c4
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            WebAdvisor.png
                                            • Path C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\WebAdvisor.png
                                            • Size 33KB
                                            • SHA256 494169cdd9c79eb4668378f770bfa55d4b140f23a682ff424441427dfab0ced2
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            botva2.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\botva2.dll
                                            • Size 37KB
                                            • SHA256 450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            finish.png
                                            • Path C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\finish.png
                                            • Size 2KB
                                            • SHA256 760b70612bb9bd967c2d15a5133a50ccce8c0bd46a6464d76875298dcc45dea0
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            prod0.zip
                                            • Path C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\prod0.zip
                                            • Size 515KB
                                            • SHA256 cc6f4faf4e8a9f4d2269d1d69a69ea326f789620fb98078cc98597f3cb998589
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            saBSI.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\prod0_extract\saBSI.exe
                                            • Size 1.1MB
                                            • SHA256 f5aa950381fbcea7d730aa794974ca9e3310384a95d6cf4d015fbdbd9797b3e4
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            prod1.zip
                                            • Path C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\prod1.zip
                                            • Size 5.9MB
                                            • SHA256 200e9bc4fcf2c6682ddc8c7f172a0d02befecd25ca882f66c6abc868a54b8975
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            WZSetup.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\prod1_extract\WZSetup.exe
                                            • Size 6.0MB
                                            • SHA256 fa352552306b80f3f897f8f21d8579ae642c97d12298e113ae1adc03902c69b8
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            prod2.zip
                                            • Path C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\prod2.zip
                                            • Size 3.6MB
                                            • SHA256 52ea32c4123bc367fc61f6624d0ac7a3d677a7eb169687c3daa3d975fbea4a5b
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            OperaGXSetup.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\prod2_extract\OperaGXSetup.exe
                                            • Size 3.6MB
                                            • SHA256 47e56b4975eeb5ed4c5f492046c069e735173c3d1b6f10a8f2dbeac5210a20a3
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            qbittorrent.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\qbittorrent.exe
                                            • Size 22.8MB
                                            • SHA256 3cec1e40e8116a35aac6df3da0356864e5d14bc7687c502c7936ee9b7c1b9c58
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            zbShieldUtils.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\is-SE620.tmp\zbShieldUtils.dll
                                            • Size 2.0MB
                                            • SHA256 7d09715c4e0735a0832bf81d92d84600df1815a2ba451586bd25eb16f7c450a5
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            mwa4F30.tmp
                                            • Path C:\Users\Admin\AppData\Local\Temp\mwa4F30.tmp
                                            • Size 135KB
                                            • SHA256 926061fc6a92079aa227cc2e426bd5b2130501422a95e6a8984f15f05dee2e70
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            mwa6FC7.tmp
                                            • Path C:\Users\Admin\AppData\Local\Temp\mwa6FC7.tmp
                                            • Size 173KB
                                            • SHA256 6dd62d41da015e4a1486a8866fcb28ac1209a552be8313dbd63e821cb46811c8
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            INetC.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\nsw456D.tmp\INetC.dll
                                            • Size 21KB
                                            • SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            WeatherZeroNSISPlugin.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\nsw456D.tmp\WeatherZeroNSISPlugin.dll
                                            • Size 695KB
                                            • SHA256 070190292df544da87f84dc8cf8ecc0a0337085a3fe744fa60ce00a6879b6146
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            9d12bdb3-4430-42ef-963a-5add8028830b.tmp
                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2520_1024965455\9d12bdb3-4430-42ef-963a-5add8028830b.tmp
                                            • Size 472KB
                                            • SHA256 791c81ca1b16b333a947dc63cc0dee14aba5a4f82a7fd5379e42ed40bea8c41e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            34202c23-e43b-4beb-ac54-e223900ecf9e.tmp
                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2520_2050419929\34202c23-e43b-4beb-ac54-e223900ecf9e.tmp
                                            • Size 2.6MB
                                            • SHA256 71c7a508f591d1771979df4fb400556c4df21d8937e017e322ee1c4749dda428
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Icon_Light_Neutral.png
                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2520_2050419929\CRX_INSTALL\icons\128\Icon_Light_Neutral.png
                                            • Size 2KB
                                            • SHA256 ec33dffd3fdb927141385a8c8eefb5fdfbd6dec9b50dfa02d66aa6377342bce2
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            a4b79f32-bb47-435b-8925-14a3541260d8.tmp
                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2520_556481226\a4b79f32-bb47-435b-8925-14a3541260d8.tmp
                                            • Size 14KB
                                            • SHA256 d6a7b4d351a6a936a754f7468b3d2ec511690c58e971f4c88b9550eb91acb3df
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            24396b26-1b96-4cc6-893a-d7be8375ef33.tmp
                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2520_58624780\24396b26-1b96-4cc6-893a-d7be8375ef33.tmp
                                            • Size 5.5MB
                                            • SHA256 a8b37d7a08098807fcb98672ee246b763650bbb27d65270ee997b2803b99c7c4
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            favicon_opera_one.png
                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2520_58624780\CRX_INSTALL\favicon_opera_one.png
                                            • Size 2KB
                                            • SHA256 44ee468b888578da502658d7f2b05b24d9034756701f49d762b00615f8da62f3
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ae9830e2bd8d88c0.customDestinations-ms
                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ae9830e2bd8d88c0.customDestinations-ms
                                            • Size 19KB
                                            • SHA256 e58ee80b784489c168b9142869373c2c333bc291c3f1a5be536892622eb02a7e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ae9830e2bd8d88c0.customDestinations-ms
                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ae9830e2bd8d88c0.customDestinations-ms
                                            • Size 15KB
                                            • SHA256 f4a148f800930d595178574b3d59071d8b23e575374b144f51445b58d5155959
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            settings.dat
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
                                            • Size 40B
                                            • SHA256 f256f64c0ae77dcec844310f5aa6e357602bbe8dc74fc2e146ba909df1128b9a
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            MANIFEST-000001
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extension Rules\MANIFEST-000001
                                            • Size 41B
                                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            messages.json
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.30.0_0\_locales\en\messages.json
                                            • Size 2KB
                                            • SHA256 57e2b257a65fa5e980c619214ed9ae25580bbd581143e28abac49928b31977a6
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            background.js
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.30.0_0\background.js
                                            • Size 17KB
                                            • SHA256 7c44c782b5e658ceeb46850ec34e316a90d1010d034706f6e5a980f48b8f1398
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            twitch16.png
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.30.0_0\icons\twitch16.png
                                            • Size 369B
                                            • SHA256 c89fb8d1c2db84a460b0d01efb2584710802a85c58efbc6963ce345343c1d1f3
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            twitch48.png
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.30.0_0\icons\twitch48.png
                                            • Size 924B
                                            • SHA256 121a7d5d60e86eab44e0f133b03be279b200a58d2c113e063f46005f1bb20208
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            cos-bridge.js
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\enegjkbbakeegngfapepobipndnebkdk\1.4.1.2_0\cos-bridge.js
                                            • Size 173B
                                            • SHA256 0c4209fe6d13d432cc0035b20f1eb58159ed23bda2417c07f9e8fed079414025
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            cos-content.js
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\enegjkbbakeegngfapepobipndnebkdk\1.4.1.2_0\cos-content.js
                                            • Size 502B
                                            • SHA256 e3b30cd7ca6d753dcf9fe91f9c1fb4eeae7b9dc00eebf87f5f24e2316b76390f
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            main.js
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\enegjkbbakeegngfapepobipndnebkdk\1.4.1.2_0\main.js
                                            • Size 46KB
                                            • SHA256 251d7ccab9ed6ea88bf36dff429cb6e1ce196465451fa877c63b97712cb20aca
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            favicon_opera_one.png
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.31.0.2_0\favicon_opera_one.png
                                            • Size 2KB
                                            • SHA256 7020bcd4e2443007b9ffd23d100268d114da2768e9c2ab99d0d4fcbafbcfa662
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            service_worker.js
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.31.0.2_0\service_worker.js
                                            • Size 55KB
                                            • SHA256 33b0859347e02c9142fd7823b297714b88e474c8278f4778efdfb01f1e6b8034
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vendors.js
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.31.0.2_0\vendors.js
                                            • Size 2.3MB
                                            • SHA256 5de428dcb2382b4110d4389a413cf40ae435b16b942e37cf9416022c6fb9b67a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            webpage_content_reporter.js
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.31.0.2_0\webpage_content_reporter.js
                                            • Size 113KB
                                            • SHA256 2f60af001760683ef280d0e8fe5cb7d91317a3c2751de436b7547c9798f6ccfc
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            background.js
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\background.js
                                            • Size 86KB
                                            • SHA256 bc24cb72eda19eaf9ee195f014bd6247e826cc594e73461b826c6bd0d5f50dce
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Icon_Light_Neutral.png
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\icons\128\Icon_Light_Neutral.png
                                            • Size 2KB
                                            • SHA256 2ab8cc6f56fb252cebe597a68724d4a60e604f87014a71f27afa865fab6309de
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            popup.js.LICENSE.txt
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\popup.js.LICENSE.txt
                                            • Size 1KB
                                            • SHA256 f10ea2db0cc0b4c4a316d6a4fb23dd6e2f19f5eb215fdbfd1709d7f2c233df8c
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            rules.json
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\rules.json
                                            • Size 839B
                                            • SHA256 2693069fe851c816f327b4cd2c5ff1bd11024b04033df827330a6fcb48cb1bf6
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            MANIFEST-000001
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\IndexedDB\https_gxcorner.games_0.indexeddb.leveldb\MANIFEST-000001
                                            • Size 23B
                                            • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            2f0939d2-589d-4560-a482-40b07decb561.tmp
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\2f0939d2-589d-4560-a482-40b07decb561.tmp
                                            • Size 27KB
                                            • SHA256 b79b047aa13202f575c92b513e67530ee9a5de4755d8d67c85c2f156c9a4eb39
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            38b49112-99c1-4953-b53d-bab505f88bb4.tmp
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\38b49112-99c1-4953-b53d-bab505f88bb4.tmp
                                            • Size 27KB
                                            • SHA256 09b4f9a23cfa587b071052ac7cd4803139d3f1775a11b4c552b92472d857f460
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            4c612d80-d28a-4cbd-9a0a-35521f28a333.tmp
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\4c612d80-d28a-4cbd-9a0a-35521f28a333.tmp
                                            • Size 27KB
                                            • SHA256 2f1a860dec73e59307d1a8e1b1ace276076ef77008f468720569bfc8d7ba2512
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            b252a667-9e31-4d77-805e-9f80fd35f0c3.tmp
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\b252a667-9e31-4d77-805e-9f80fd35f0c3.tmp
                                            • Size 27KB
                                            • SHA256 cc914b6c8be70f233d533244b1fe41e32c495b9bb57901a96777f7d19fd75dfa
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            b46d877b-f72e-4cbc-b80b-77c1401e4a5e.tmp
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\b46d877b-f72e-4cbc-b80b-77c1401e4a5e.tmp
                                            • Size 27KB
                                            • SHA256 c5b282a24d9ef3ca8b9ec9a229d76f55e76c8765f3d55b13ae9d0f6501c7b0fd
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Opera Custom Icon.ico
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Opera Custom Icon.ico
                                            • Size 162KB
                                            • SHA256 655050396cfac8e23abeed21171996030b98d079090918ccf869830caa20cf6b
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Preferences
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences
                                            • Size 12KB
                                            • SHA256 f86634d5c8586d50cc1b58e7cbfc39a345aa1978c67fadd83d2433d074d0d252
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Preferences~RFe5a8687.TMP
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences~RFe5a8687.TMP
                                            • Size 12KB
                                            • SHA256 8fabe0d0f7a003f15eb69487a4eb263016f6d155768af04fa775413ceee7ee15
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Secure Preferences
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Secure Preferences
                                            • Size 208KB
                                            • SHA256 4b87e1cb33d4c4d82715e97a70e29545e410b6ff92372f339ceb226b8392fa0f
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Secure Preferences~RFe5a86c5.TMP
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Secure Preferences~RFe5a86c5.TMP
                                            • Size 83KB
                                            • SHA256 fefa63dbff90ae4f40f6217ed264c5f9be624b3b3acd52d9f437058f88497068
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            index
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\a2454e63-a95a-44d0-a654-604469864a7f\index
                                            • Size 24B
                                            • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            the-real-index
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\a2454e63-a95a-44d0-a654-604469864a7f\index-dir\the-real-index
                                            • Size 96B
                                            • SHA256 85abd8744d297a84a4211e8b859eca3b4425fd854e1d1be61621a8d6df2a9dfa
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            the-real-index~RFe5a63cc.TMP
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\a2454e63-a95a-44d0-a654-604469864a7f\index-dir\the-real-index~RFe5a63cc.TMP
                                            • Size 48B
                                            • SHA256 6038695f769a119cd4991af0a3f401042ad99723d938ffe41fcc786159467694
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            index.txt
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\index.txt
                                            • Size 135B
                                            • SHA256 62ebce504a2a3d32910a0db65e3644dea6b0fb331730c5de7598340f6547fe4c
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            index.txt~RFe5aa9ed.TMP
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\index.txt~RFe5aa9ed.TMP
                                            • Size 141B
                                            • SHA256 b83e866aa42292e59eaa998e6f82abb3ffa7f4243ee0a456700a26e58ae2e09b
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 573B
                                            • SHA256 8caae96becec7ac89cca165a3a690da706cb2577572d80b571e290e814e2f187
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 733B
                                            • SHA256 92a61a441cfffb343f1dd54b092be6c8fe8db6ac0e61f9f160a757e2c5d5449c
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 861B
                                            • SHA256 b50affc9e30f7cccc6aa0f8250966fdcd888fd7d022879a86bc9b185bab52454
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 2KB
                                            • SHA256 065938bb7ca11620047a257eabb074e78b2b60ba5f4b8788eccc6774f07b1626
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 8KB
                                            • SHA256 a96632653555126a12364357a15eecce3f48ee457356a10b192d4ed4f9aaedb9
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 8KB
                                            • SHA256 f878a826b30b7f816bc87f7e312086ec3e2c78f93c5f741d346728d44b139c2a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 7f7afd73cb05417a39b5fb82ced36da0666d56334ad43791e4067c5392dfdc41
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 7dac0b58a2e110c1c8d19117e25297bfd8d2a0a530f6d03bca61b93de7ed2370
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 11KB
                                            • SHA256 91e5d6645206d5302b40beba358ae85bc9d6263d6cae43c15c848a97810cab2e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 11KB
                                            • SHA256 f6d6554158fb7be3b82783e12bf1b86862af5519522c7c89e3b476f70aae1b1b
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 12KB
                                            • SHA256 300c5fcf284764e112089921b194c532f8ff6814b26020eff85ac1fb682d660d
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 12KB
                                            • SHA256 23efad93e174d60d55fbfd32136196fc221cf992acbece1b12f28e19d018e2bd
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 12KB
                                            • SHA256 07bbb63151b50b0d175206c4d93b58e890edf33b1e3b3acf7c1f0f0b626b476c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 11KB
                                            • SHA256 1dd1ffda7dc180a006067543f85a4ec2a2d82ed6964e8cfc5ef1e4e200af0d0d
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 1005B
                                            • SHA256 a86662e9a449d7669191688eac9b7496d01fb7c765569be4f66ee61cb03d1d79
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 1KB
                                            • SHA256 6830513efae9efbc8bf9b3cf7cd7dfd3ce77505f2be1b3a6c6b469b2f0fedf63
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 1KB
                                            • SHA256 fba975173c4e752aaba132a033335c5ff1757b1d81e0bcfc961d3fd2c8bb369b
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 1KB
                                            • SHA256 c468766511ec32669ff1924d695dabda2697e962ccd69140238033679748e786
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 1KB
                                            • SHA256 f4710845d653e568f67fd420405f803cc2794c35bb661c2ee1508417995b2767
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 1KB
                                            • SHA256 471c5d321c9cdcdda6cec10bcf817eede658159bc21bd1c171221e4d1774ee0a
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 1KB
                                            • SHA256 72344e67cffc55a6d8c4c2dbc85e3e48897780e467d4e1f910a07f3600e51da9
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 1KB
                                            • SHA256 2d4181d7af0e7fe1993b0748e262c81983879fbc04be249f6d9731abdffeb41b
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 2KB
                                            • SHA256 de0f5b69349c5f3b903b5d2953766b8fb558278858c76a219d884876e3edddac
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 2KB
                                            • SHA256 295433e3537157cc92ae6c3e7a447bfef5d020c019d430448e7a9c34345d652b
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 2KB
                                            • SHA256 2b3a91faa19a77830e2523946e2d675487e32172c2d485c8da1d6e1d325add74
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 2KB
                                            • SHA256 0fcfede204edb36e54aca626cd4362b700aa629576a4807862f51d699c8c2c34
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 2KB
                                            • SHA256 2c915f2226696138d362860cf6bfbf21ff2785710b138f4ddd419c212fefdc6f
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 2KB
                                            • SHA256 d3a88ce9c5fef823834010f115b0dedb64b478f70c088b4387f9370b0ff0b2fb
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 2KB
                                            • SHA256 72852acf2ba762c479ff01cf28770377dd52efb0f89ad84ca480afeee46d7627
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 2KB
                                            • SHA256 32c32a48c9b2d9871ca79cc694af701daa8d8ee0cb67ee6f691f52fac7653272
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 2KB
                                            • SHA256 8583e2dc0c4bf2825875bec11ffd08bb956b308a57a2d4c0571034a3f8bbcf44
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 2KB
                                            • SHA256 7f98a4f9c57def122fd8b267d5eae3eacc3a52944ec9978fcf4da4b05f24828b
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 2KB
                                            • SHA256 bcb1609d3cf1f036d5ec01421c32b1a3cb7966a4f40144953273486ebdc57b55
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 3KB
                                            • SHA256 13d1ffa1fbcbbb3982876955ca139e6a1a9866a797cbb0ac5d07449d0f2043a8
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 8KB
                                            • SHA256 f449ef3ed4d73b9aae905701e1d3965618179ddba6ef8695947cb84622ebdf2a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 8KB
                                            • SHA256 5142ed79d750bdd99f4e18b0d7bc3586d2e1b2de760db08a8de6f61ab8ac4a1f
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 48d644d8732433ad6e70f2b4b9a10449773dbc4d9506dd0fbee280e933a16c5d
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 f1b4ac7e70fa7f267efb0b07156b67af0d89a56d98f0d0d9a53fca15eb5cefc5
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 1483bba4ba26af527b947982760fa685e5f0dc988d53de1282af0f68bed35c42
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 6d3debb0fbd034dda6a421f6605cfc0f17f631d0d8b9ce627dd45034ed0164e0
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 041d71aaeb03da061a988716dd3890e3e60ec5b94c7701a7b853e3721d3e1688
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 1b2d366596b1f6e0341726ddcb952668d214bf0cc2d7a8e98f4b52bf04f7639c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 269c4c44619460965df301a3096bb41ca278503f62062167053fb3e358141b99
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 46eb48ee320dd6f404803fd4fe8586effd2c77be38f34cc1f24dc74b108d5dde
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 49ace7385f04f842be9bba185b93e85aa97646f115a7e95b78b277ec42771ca9
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 47e80525ab56edbc61c87e3da767fcd0cc93d933be97d27724c9894fc1552cc1
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 79d93d899a5c5ba12f83d12b6b5dc82261e1a1450bbed00ce3f2d0b3b3c74170
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 40cbfb71d8e2a902a8c643e17f74480c6d6d0f61843d5b16b608b0bd883686d9
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 1592ba5c26632a66965410354edede12cacbfc91079f160d041ff703b3d71be5
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 b8b4d37bb1a98a0a46ec20c494e00cc9e6c20c092943fea549397b008993c3df
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 d8e50e3e51f8e0afc2b7febc1faa910c43b757d4a04308614c31aeb297d82ec2
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 6e754caf021a1ce960614461424ca4b92f03e44f8f1e2e1286ee1182d6dfff56
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 10KB
                                            • SHA256 f73b2693fd10b04b6a8d93c56d62dd389592a3c29c27e615362739ee05da2aea
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 10KB
                                            • SHA256 5911c396ec9f2b435562ed0f81254bbad712acc40773d2af1658bd57bff9a46e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 11KB
                                            • SHA256 b75cb7fd2bb6b8a5bbe20c421e055ae67f81d3e873d4897e1f4e62daee21e5a4
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 12KB
                                            • SHA256 a6d8f44cedd69c94ed6b0da5f3dad2355904a6783a1e5aff46b79b0b7a5e2354
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 12KB
                                            • SHA256 959ba8018fd3b13b9eb41bd9305e9ad90a39695d1c76727dcdf916e5a2675570
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 2KB
                                            • SHA256 cb7bc44c961e997265371f34763fc01c75778c34cb804e75658eb34426154cc9
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 2KB
                                            • SHA256 9d1688aa9bb5b242a8aca283331c3981b480e830af3d7ecee34135fa666d2b0b
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 12KB
                                            • SHA256 722a01691685f1de42fdc098571a592c1656e5e1c1710ba6253e3829c3ad8411
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 8KB
                                            • SHA256 5c749cec9ea67867d2aac52ee014790ce6c1c90a8fd213ec21dbc77dc444ecfa
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 103647bbaa7526f8bd1b75a5413b30760ca4cf357726b79bf5aa612ac95a54a6
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 e51b78507be57b985331d3cd7b859a2f642515faa019abe29613a5e673c9b2d8
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 75f7351e31ed64c8bb4a25abb33a8755a0c848cf03ce35668af636577d962391
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 10KB
                                            • SHA256 39bfc2977a4619f2aefe64417bdffd816a603050b56afb69e00217ac1db69e26
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 10KB
                                            • SHA256 15bf6017b15bf213cc2fc9eae8ebe4b2f2fe3ddfb65e3646a21807794de1620f
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 10KB
                                            • SHA256 b69ba0a1ab062cd73987a6c0d299d28d399a236dc08fb1e85cbb558cb9bf1823
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 11KB
                                            • SHA256 c32312aed2aeded144257caf2849b3f48d01f9c6ab85ab56f3c190dedb659a57
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 12KB
                                            • SHA256 76f2cbdba838abe7e7839aa9cdd70c2c78a1092c6cb0d60561d3d16f39dc19f6
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 12KB
                                            • SHA256 d564b3826379e2febc3249c947cca14e8c97821171bdfc73bc1dd719b47664ad
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 12KB
                                            • SHA256 93e7082d5cb860efb7ff18d72d99b7a9e830a43067735bf6a0d0640056d2cba6
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 12KB
                                            • SHA256 acf71e9019d2c6bbe495c1115c80480ec6404c7f826cbe84d5ac7169313cc44f
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 11KB
                                            • SHA256 738d30eb1af09099a6f118da320b1995addb91a22751b7b7ca11fae6fbb38c9f
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 9KB
                                            • SHA256 3fd23118d67a4a590c337cd1f9769dc3dcacf1b8f2bd2614087999be63ea95bb
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw
                                            • Size 3KB
                                            • SHA256 7ad559e11ae906727f7cbf16742ad2d3d1ff8fc224e922899bb50c9d8570bf96
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw~RFe5a3857.TMP
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_116feb31-9221-45e1-a5ea-8b78b3a90ac5.raw~RFe5a3857.TMP
                                            • Size 461B
                                            • SHA256 93ee4e3281d8a42a68f58077ced4242e7bbfa2082616d675452d48fe5f5973a5
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            CURRENT
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Sync Data\LevelDB\CURRENT
                                            • Size 16B
                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 599B
                                            • SHA256 5d70db75343af48b8ef54852b6172f1e0a1b4e1c77cd78b6f6733decefb4a117
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 692B
                                            • SHA256 7a10d8b92553fa9ecd4cc901031b614cfec830a990c200b27a300f1223a58152
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 1KB
                                            • SHA256 5e8bb36d49dd81b9e453df6b439454d4ab469ae780539ad93e02384ca1c0d2e7
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 1KB
                                            • SHA256 4472712c8df1aa16c18e10cb6f39b7f3aee4bae055fcfa5537629560249f51f7
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 1KB
                                            • SHA256 b465bb76e4452c855020b76f3d82837906a0d01618783993e78dd25e26d9c660
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 1KB
                                            • SHA256 675494e8f76860533ad1af9e626dacda912c400b67a0e4f3543aa598c62a2bcb
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 1KB
                                            • SHA256 8fd7cc3bd99ae381a7af15fa2276e45d8fc1aec090b6d7ef6ab9ddc438128a55
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 507B
                                            • SHA256 d40ea434b83fe4a802a7f6a0a1ff8309adef4eddfb8263270d096f200c5a4b9c
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 878B
                                            • SHA256 aaa6a100a3c4d01439cefd0e59b23c566ade6b757ace4e8a839c5dfc05380a4e
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 1KB
                                            • SHA256 714db2ac11a55673b22b4f33e06517f5379978ceb89735ab0f20e0b526808069
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 1KB
                                            • SHA256 7e35e922585462ccf459fa74f3fa5749777f26287680ef10b73ad3dae89cb8d8
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 3KB
                                            • SHA256 2dbf489e4d40777bc580a4c16f5301ec6824aa3ca947aa17c861096d100051e8
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 3KB
                                            • SHA256 7e4ef8013eba1cf4056bb804e15c1d48fa8f1ea78cb016776db18fccc73078de
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 3KB
                                            • SHA256 4e6890799dc688af6625739f7c4cbf3495f9ce115fa6f92b8acb4b3bd094a6d8
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 3KB
                                            • SHA256 b4b89302a71615e8450f0c642e17ca6eef0b9f5b64d58a312bf7aa2e6745ec4c
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 781B
                                            • SHA256 ea2eeef00034f01718ad97243528277ae2728d63c4e2dfc0088bc15b789b4289
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 3KB
                                            • SHA256 783da2a063c19b72b00a3662ea450145ac0314cf86e392fb2a62ec75e56bda7f
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 979B
                                            • SHA256 a611024670dbca252a8aa245ae76e4cea78db6e54de7c48c9fa287e1571c6d31
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 1KB
                                            • SHA256 6e8c814629cb60abd9fa35cd5849213d1c71527aab2d895d222a9e3811ef98ea
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 2KB
                                            • SHA256 f0a1337da710af19210bf067f0aae14e10b8dc4203d9f6ff6f26e24b948b4643
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 2KB
                                            • SHA256 41dabc68475b2f309936ccf70520f13b7745e2bf355189e7dc7dce4c180d487f
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 3KB
                                            • SHA256 706349592fb21a089b719beddf605120557dc1aa9609035a710b04bc8ddbd3f8
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461
                                            • Size 3KB
                                            • SHA256 ba912c9bc7062432e7255933a43b57e9c4ac5884aeb8f3d0b3bfb29e5943cded
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.0.701493461~RFe5a4373.TMP
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.0.701493461~RFe5a4373.TMP
                                            • Size 414B
                                            • SHA256 87c57ca4b7c6034a65defb36c3ca2823effbdf7d1011cdaebbcd8e9f84805eb8
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.1.1560658127
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.1.1560658127
                                            • Size 224B
                                            • SHA256 c17258cb29bc904511f78ef58c508541b05782b0cef61ffba8c9e96af6915df1
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.1.1560658127
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.1.1560658127
                                            • Size 200B
                                            • SHA256 a41e400e7e8a8e4895e51c57d3bb75e14439eea84f2215587c318a6eaeba875b
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.1.1560658127
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.1.1560658127
                                            • Size 224B
                                            • SHA256 322bdde46c3f36ee923970f941eb285838fedbf3cb289dfefe0d6033a79537b3
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ssdfp2520.1.1560658127~RFe5a444e.TMP
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2520.1.1560658127~RFe5a444e.TMP
                                            • Size 171B
                                            • SHA256 3a4996acb7135d8f854bc51f91ac877d3de9d48b3039b10f30921da2bb1c6c50
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            data_0
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_0
                                            • Size 8KB
                                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            data_1
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_1
                                            • Size 264KB
                                            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            data_2
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_2
                                            • Size 8KB
                                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            data_3
                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_3
                                            • Size 8KB
                                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            qBittorrent.ini
                                            • Path C:\Users\Admin\AppData\Roaming\qBittorrent\qBittorrent.ini
                                            • Size 1KB
                                            • SHA256 41eb2aafcbe2ae9fcfd1f332aaef31fefbe4051c3e9d6d64f7b5f031626e0bf9
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            watched_folders.json
                                            • Path C:\Users\Admin\AppData\Roaming\qBittorrent\watched_folders.json
                                            • Size 4B
                                            • SHA256 d914176fd50bd7f565700006a31aa97b79d3ad17cee20c8e5ff2061d5cb74817
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            Vista.Emulation.zip
                                            • Path C:\Users\Admin\Downloads\Purble place\Vista.Emulation.zip
                                            • Size 27KB
                                            • SHA256 e44a9f368d4791bed7a27027fe8940643716bfde51014da6a57ae0748a3caefe
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            purble_place.zip
                                            • Path C:\Users\Admin\Downloads\Purble place\purble_place.zip
                                            • Size 55.4MB
                                            • SHA256 171db88302c26c586202aafd6a75a54349b56ff7798cc7e71cfcd9608fe46260
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            memory/2060-289-0x00000000008D0000-0x00000000008E9000-memory.dmp
                                            Download

                                            memory/2416-444-0x0000000000F80000-0x000000000103F000-memory.dmp
                                            Download

                                            memory/2472-288-0x00000000039D0000-0x00000000039DA000-memory.dmp
                                            Download

                                            memory/2472-287-0x0000000003850000-0x0000000003869000-memory.dmp
                                            Download

                                            memory/2628-477-0x000001CF110A0000-0x000001CF110AC000-memory.dmp
                                            Download

                                            memory/2708-2442-0x000000001A9D0000-0x000000001AB06000-memory.dmp
                                            Download

                                            memory/2708-2421-0x0000000000CE0000-0x0000000000D00000-memory.dmp
                                            Download

                                            memory/2708-2433-0x000000001A2D0000-0x000000001A6A4000-memory.dmp
                                            Download

                                            memory/4140-324-0x0000000000860000-0x0000000000879000-memory.dmp
                                            Download

                                            memory/4652-502-0x0000000000A80000-0x0000000000B3F000-memory.dmp
                                            Download

                                            memory/4652-501-0x0000000000400000-0x00000000004CC000-memory.dmp
                                            Download

                                            memory/4652-14-0x0000000000400000-0x00000000004CC000-memory.dmp
                                            Download

                                            memory/4652-15-0x0000000000A80000-0x0000000000B3F000-memory.dmp
                                            Download

                                            memory/4652-0-0x0000000000400000-0x00000000004CC000-memory.dmp
                                            Download

                                            memory/4672-509-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-461-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-517-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-481-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-518-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-519-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-524-0x00007FF65A230000-0x00007FF65A240000-memory.dmp
                                            Download

                                            memory/4672-547-0x00007FF65A230000-0x00007FF65A240000-memory.dmp
                                            Download

                                            memory/4672-480-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-513-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-550-0x00007FF65A230000-0x00007FF65A240000-memory.dmp
                                            Download

                                            memory/4672-512-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-552-0x00007FF65A230000-0x00007FF65A240000-memory.dmp
                                            Download

                                            memory/4672-548-0x00007FF65E0B0000-0x00007FF65E0C0000-memory.dmp
                                            Download

                                            memory/4672-558-0x00007FF6BA340000-0x00007FF6BA350000-memory.dmp
                                            Download

                                            memory/4672-585-0x00007FF688350000-0x00007FF688360000-memory.dmp
                                            Download

                                            memory/4672-570-0x00007FF6A39F0000-0x00007FF6A3A00000-memory.dmp
                                            Download

                                            memory/4672-566-0x00007FF688350000-0x00007FF688360000-memory.dmp
                                            Download

                                            memory/4672-520-0x00007FF68B940000-0x00007FF68B950000-memory.dmp
                                            Download

                                            memory/4672-505-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-488-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-511-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-510-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-478-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-515-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-508-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-456-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-516-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-457-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-458-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-490-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-492-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-459-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-494-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-496-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-497-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-514-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4672-507-0x00007FF6AB5E0000-0x00007FF6AB5F0000-memory.dmp
                                            Download

                                            memory/4696-41-0x00000000067B0000-0x00000000067BF000-memory.dmp
                                            Download

                                            memory/4696-21-0x0000000000400000-0x00000000006EE000-memory.dmp
                                            Download

                                            memory/4696-212-0x00000000067B0000-0x00000000067BF000-memory.dmp
                                            Download

                                            memory/4696-5-0x0000000002690000-0x0000000002691000-memory.dmp
                                            Download

                                            memory/4696-64-0x0000000000400000-0x00000000006EE000-memory.dmp
                                            Download

                                            memory/4696-66-0x00000000067B0000-0x00000000067BF000-memory.dmp
                                            Download

                                            memory/4696-49-0x0000000000400000-0x00000000006EE000-memory.dmp
                                            Download

                                            memory/4696-51-0x00000000067B0000-0x00000000067BF000-memory.dmp
                                            Download

                                            memory/4696-473-0x0000000000400000-0x00000000006EE000-memory.dmp
                                            Download

                                            memory/4696-485-0x0000000000400000-0x00000000006EE000-memory.dmp
                                            Download

                                            memory/4696-208-0x0000000000400000-0x00000000006EE000-memory.dmp
                                            Download

                                            memory/4696-16-0x0000000000400000-0x00000000006EE000-memory.dmp
                                            Download

                                            memory/4696-17-0x0000000004EA0000-0x0000000004EB9000-memory.dmp
                                            Download

                                            memory/4696-18-0x0000000002690000-0x0000000002691000-memory.dmp
                                            Download

                                            memory/4696-486-0x0000000004EA0000-0x0000000004EB9000-memory.dmp
                                            Download

                                            memory/5336-476-0x0000000003920000-0x000000000392A000-memory.dmp
                                            Download

                                            memory/5336-475-0x00000000011A0000-0x00000000011B9000-memory.dmp
                                            Download